theory Fastpath_C

lemma fastpath_reply_recv_ccorres:
  notes hoare_TrueI[simp]
  shows "ccorres dc xfdc
       (\<lambda>s. invs' s \<and> ct_in_state' ((=) Running) s
               \<and> obj_at' (\<lambda>tcb.  (atcbContextGet o tcbArch) tcb capRegister = cptr
                              \<and>  (atcbContextGet o tcbArch) tcb msgInfoRegister = msginfo)
                     (ksCurThread s) s)
       (UNIV \<inter> {s. cptr_' s = cptr} \<inter> {s. msgInfo_' s = msginfo}) []
       (fastpaths SysReplyRecv) (Call fastpath_reply_recv_'proc)" proof - have [simp]: "Kernel_C.tcbCaller = scast tcbCallerSlot" by (simp add:Kernel_C.tcbCaller_def tcbCallerSlot_def) have [simp]: "Kernel_C.tcbVTable = scast tcbVTableSlot" by (simp add:Kernel_C.tcbVTable_def tcbVTableSlot_def) have tcbs_of_cte_wp_at_vtable:
    "\<And>s tcb ptr. tcbs_of s ptr = Some tcb \<Longrightarrow>
    cte_wp_at' \<top> (ptr + 0x10 * tcbVTableSlot) s" apply (clarsimp simp:tcbs_of_def cte_at'_obj_at'
      split:if_splits) apply (drule_tac x = "0x10 * tcbVTableSlot" in bspec) apply (simp add:tcb_cte_cases_def tcbVTableSlot_def) apply simp done have tcbs_of_cte_wp_at_caller:
    "\<And>s tcb ptr. tcbs_of s ptr = Some tcb \<Longrightarrow>
    cte_wp_at' \<top> (ptr + 0x10 * tcbCallerSlot) s" apply (clarsimp simp:tcbs_of_def cte_at'_obj_at'
      split:if_splits) apply (drule_tac x = "0x10 * tcbCallerSlot" in bspec) apply (simp add:tcb_cte_cases_def tcbCallerSlot_def) apply simp done have tcbs_of_aligned':
    "\<And>s ptr tcb. \<lbrakk>tcbs_of s ptr = Some tcb;pspace_aligned' s\<rbrakk> \<Longrightarrow> is_aligned ptr tcbBlockSizeBits" apply (clarsimp simp:tcbs_of_def obj_at'_def split:if_splits) apply (drule pspace_alignedD') apply simp+ apply (simp add:projectKO_opt_tcb objBitsKO_def
      split: Structures_H.kernel_object.splits) done 

  (* FIXME indentation is wonky in this proof, fix will come in a future patch, hopefully when
     automatic indentation is improved *)
   show ?thesis using [[goals_limit = 1]] supply option.case_cong_weak[cong del] supply if_cong[cong] apply (cinit lift: cptr_' msgInfo_') apply (simp add: catch_liftE_bindE unlessE_throw_catch_If
                      unifyFailure_catch_If catch_liftE
                      getMessageInfo_def alternative_bind
                cong: if_cong call_ignore_cong del: Collect_const) apply (rule ccorres_pre_getCurThread) apply (rename_tac curThread) apply (rule ccorres_symb_exec_l3[OF _ user_getreg_inv' _ empty_fail_user_getreg])+ apply (rename_tac msginfo' cptr') apply (rule_tac P="msginfo' = msginfo \<and> cptr' = cptr" in ccorres_gen_asm) apply (simp del: Collect_const cong: call_ignore_cong) apply (simp only:) apply (csymbr, csymbr) apply (rule ccorres_rhs_assoc2) apply (rule_tac r'="\<lambda>ft ft'. (ft' = scast seL4_Fault_NullFault) = (ft = None)"
                 and xf'="ret__unsigned_'" in ccorres_split_nothrow) apply (rule_tac P="cur_tcb' and (\<lambda>s. curThread = ksCurThread s)"
                     in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cur_tcb'_def rf_sr_ksCurThread) apply (drule(1) obj_at_cslift_tcb, clarsimp) apply (clarsimp simp: typ_heap_simps' ctcb_relation_def cfault_rel_def) apply (rule rev_bexI, erule threadGet_eq) apply (clarsimp simp: seL4_Fault_lift_def Let_def split: if_split_asm) apply ceqv apply csymbr apply csymbr apply (simp only:) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_alternative2) apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres) apply simp apply simp apply (vcg exspec=slowpath_noreturn_spec) apply (rule ccorres_alternative1) apply (rule ccorres_if_lhs[rotated]) apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (solves \<open>simp add: signed_n_msgRegisters_to_H\<close>) apply (simp del: Collect_const cong: call_ignore_cong) apply (elim conjE) apply (simp add: getThreadCSpaceRoot_def locateSlot_conv
                   del: Collect_const cong: call_ignore_cong) apply (rule ccorres_pre_getCTE2) apply (rule ccorres_abstract_ksCurThread, ceqv) apply (rule ccorres_move_array_assertion_tcb_ctes
                   ccorres_move_c_guard_tcb_ctes3
                   ccorres_move_const_guard
                   ccorres_rhs_assoc)+ apply (ctac add: lookup_fp_ccorres) apply (rename_tac luRet ep_cap) apply (rule ccorres_abstract_ksCurThread, ceqv) apply (rule ccorres_move_array_assertion_tcb_ctes
             | simp del: Collect_const cong: call_ignore_cong)+ apply (csymbr, csymbr) apply (simp add: ccap_relation_case_sum_Null_endpoint
                          of_bl_from_bool from_bool_0
                     del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: if_1_0_0 cong: if_cong) apply (rule ccorres_cond_true_seq) apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (erule disjE; simp; rule slowpath_ccorres) apply simp apply simp apply (vcg exspec=slowpath_noreturn_spec) apply (rule ccorres_rhs_assoc)+ apply csymbr+ apply (simp add: if_1_0_0 isRight_case_sum
                     del: Collect_const cong: call_ignore_cong) apply (elim conjE) apply (frule(1) cap_get_tag_isCap[THEN iffD2]) apply (simp add: ccap_relation_ep_helpers from_bool_0
                     del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres) apply simp apply simp apply (vcg exspec=slowpath_noreturn_spec) apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_pre_getBoundNotification) apply (rule ccorres_rhs_assoc2) apply (rule_tac xf'=ret__int_' and r'="\<lambda>rv rv'. rv' = from_bool rv"
                 in ccorres_split_nothrow) apply (rule_tac P="bound_tcb_at' ((=) bound_ntfn) curThread
                        and valid_objs' and no_0_obj'
                        and (\<lambda>s. curThread = ksCurThread s)" in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: rf_sr_ksCurThread pred_tcb_at'_def) apply (drule(3) obj_at_bound_tcb_grandD, clarsimp simp: typ_heap_simps if_1_0_0 return_def) apply (simp add: in_liftM Bex_def getNotification_def getObject_return objBits_simps'
                                return_def cnotification_relation_isActive
                                trans [OF eq_commute from_bool_eq_if]) apply ceqv apply (simp only: from_bool_0) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_split_throws) apply simp apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp del: Collect_const cong: call_ignore_cong) apply (csymbr, csymbr) apply (simp add: ccap_relation_ep_helpers
                         del: Collect_const cong: call_ignore_cong) apply (rule_tac xf'="ret__unsigned_'"
                          and r'="\<lambda>ep v. (v = scast EPState_Send) = isSendEP ep"
                         in ccorres_split_nothrow) apply (rule ccorres_add_return2) apply (rule ccorres_pre_getEndpoint, rename_tac ep) apply (rule_tac P="ko_at' ep (capEPPtr (theRight luRet)) and valid_objs'"
                              in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply (erule cmap_relationE1[OF cmap_relation_ep], erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps') apply (simp add: cendpoint_relation_def Let_def isSendEP_def
                                  endpoint_state_defs
                           split: endpoint.split_asm) apply ceqv apply (rename_tac send_ep send_ep_is_send) apply (rule_tac P="ko_at' send_ep (capEPPtr (theRight luRet))
                                    and valid_objs'" in ccorres_cross_over_guard) apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp del: Collect_const not_None_eq) apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp add: getThreadVSpaceRoot_def locateSlot_conv
                                getThreadCallerSlot_def
                           del: Collect_const cong: if_cong call_ignore_cong) apply (rule ccorres_abstract_ksCurThread, ceqv) apply (rename_tac ksCurThread_y) apply (rule ccorres_move_const_guard
                           ccorres_move_c_guard_tcb_ctes2
                           ccorres_move_array_assertion_tcb_ctes)+ apply (rule_tac xf'="ksCurThread_' \<circ> globals"
                           and val="tcb_ptr_to_ctcb_ptr curThread"
                           in ccorres_abstract_known) apply (rule Seq_weak_ceqv, rule Basic_ceqv) apply (rule rewrite_xfI, clarsimp simp only: o_def) apply (rule refl) apply csymbr apply (rule ccorres_move_c_guard_cte) apply (rule_tac var="callerCap_'" and var_update="callerCap_'_update"
                            in getCTE_h_val_ccorres_split[where P=\<top>]) apply simp apply ceqv apply (rename_tac caller_cap caller_cap_c) apply (rule_tac P="\<lambda>_. capAligned (cteCap caller_cap)"
                            in ccorres_cross_over_guard) apply (rule ccorres_add_return, ctac add: fastpath_reply_cap_check_ccorres) apply (drule spec, drule_tac P="ccap_relation cp caller_cap_c" for cp in mp, assumption) apply (simp add: from_bool_0
                         del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp cong: conj_cong) apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp del: Collect_const cong: call_ignore_cong) apply (csymbr, csymbr) apply (rule_tac r'="\<lambda>ft ft'. (ft' = scast seL4_Fault_NullFault) = (ft = None)"
                        and xf'="ret__unsigned_'" in ccorres_split_nothrow) apply (rule threadGet_vcg_corres) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: obj_at_tcbs_of) apply (clarsimp simp: typ_heap_simps' ctcb_relation_def cfault_rel_def
                                         ccap_relation_reply_helper) apply (clarsimp simp: seL4_Fault_lift_def Let_def split: if_split_asm) apply ceqv apply csymbr apply (simp del: Collect_const not_None_eq cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp del: Collect_const not_None_eq) apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_move_c_guard_tcb_ctes3 ccorres_move_const_guards
                             ccorres_move_array_assertion_tcb_ctes)+ apply (rule_tac var="newVTable_'" and var_update="newVTable_'_update"
                                in getCTE_h_val_ccorres_split[where P=\<top>]) apply simp apply ceqv apply (rename_tac pd_cap pd_cap_c) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=ret__unsigned_' in ccorres_abstract, ceqv) apply (rename_tac pd_cap_c_ptr_maybe) apply csymbr+ apply (simp add: isValidVTableRoot_conv from_bool_0
                               del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp del: Collect_const cong: call_ignore_cong) apply (drule isValidVTableRootD) apply (rule_tac P="pd_cap_c_ptr_maybe = capUntypedPtr (cteCap pd_cap)"
                               in ccorres_gen_asm2) apply (simp add: ccap_relation_pd_helper cap_get_tag_isCap_ArchObject2
                                    ccap_relation_reply_helper
                                    ptr_add_assertion_positive
                               cong: call_ignore_cong) apply (rule ccorres_move_array_assertion_pd
                          | (rule ccorres_flip_Guard ccorres_flip_Guard2,
                             rule ccorres_move_array_assertion_pd)
                          |  rule ccorres_flip_Guard2, rule ccorres_Guard_True_Seq)+ apply (rule stored_hw_asid_get_ccorres_split[where P=\<top>], ceqv) apply (simp del: Collect_const) apply (ctac add: getCurDomain_maxDom_ccorres_dom_') apply (rename_tac curDom curDom') apply (rule_tac P="curDom \<le> maxDomain" in ccorres_gen_asm) apply (simp add: prio_and_dom_limit_helpers del: Collect_const) apply (rule ccorres_move_c_guard_tcb) apply (rule ccorres_pre_threadGet) apply (ctac add: isHighestPrio_ccorres) apply (rename_tac highest highest') apply (clarsimp simp: to_bool_def simp del: Collect_const) apply (rule ccorres_cond_seq) apply (rule ccorres_cond2'[where R=\<top>], blast) apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp del: Collect_const add: from_bool_0 cong: call_ignore_cong) apply csymbr+ apply (rule ccorres_symb_exec_l3[OF _ gets_inv _ empty_fail_gets]) apply (rename_tac asidMap) apply (rule_tac P="asid_map_pd_to_hwasids asidMap (capPDBasePtr (capCap ((cteCap pd_cap))))
                                            = set_option (pde_stored_asid shw_asid)" in ccorres_gen_asm) apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: pde_stored_asid_def asid_map_pd_to_hwasids_def) apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp add: pde_stored_asid_def asid_map_pd_to_hwasids_def
                                       to_bool_def
                                  del: Collect_const cong: call_ignore_cong) apply (rule ccorres_move_c_guard_tcb ccorres_move_const_guard)+ apply (rule ccorres_symb_exec_l3[OF _ threadGet_inv _ empty_fail_threadGet]) apply (rename_tac destDom) 

                    (* The C does not compare domains when maxDomain is 0, since then both threads
                       will be in the current domain. Since we can show both threads must be
                       \<le> maxDomain, we can rewrite this test to only comparing domains even when
                       maxDomain is 0, making the check identical to the Haskell. *)
                     apply (rule ccorres_seq_cond_raise[THEN iffD2]) apply (rule_tac R="obj_at' ((=) destDom \<circ> tcbDomain)
                                                  (capTCBPtr (cteCap caller_cap))
                                        and (\<lambda>s. ksCurDomain s = curDom \<and> curDom \<le> maxDomain
                                                 \<and> destDom \<le> maxDomain)"
                                   in ccorres_cond2') apply clarsimp apply (drule(1) obj_at_cslift_tcb)+ apply (clarsimp simp: typ_heap_simps' rf_sr_ksCurDomain) apply (drule ctcb_relation_tcbDomain[symmetric]) apply (case_tac "0 < maxDomain"
                             ; solves \<open>clarsimp simp: maxDom_sgt_0_maxDomain not_less\<close>) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_call_hSkip) apply (rule slowpath_ccorres, simp+) apply (vcg exspec=slowpath_noreturn_spec) apply (simp add: pde_stored_asid_def asid_map_pd_to_hwasids_def
                                del: Collect_const cong: call_ignore_cong) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule_tac xf'=xfdc and r'=dc in ccorres_split_nothrow) apply (rule_tac P="capAligned (theRight luRet)" in ccorres_gen_asm) apply (rule_tac P=\<top> and P'="\<lambda>s. ksCurThread s = curThread"
                                   in threadSet_ccorres_lemma3) apply vcg apply (clarsimp simp: rf_sr_ksCurThread typ_heap_simps'
                                              h_t_valid_clift_Some_iff) apply (clarsimp simp: capAligned_def isCap_simps objBits_simps
                                              "StrictC'_thread_state_defs" mask_def) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                                              typ_heap_simps' objBits_defs) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def typ_heap_simps'
                                               update_tcb_map_tos map_to_tcbs_upd) apply (subst map_to_ctes_upd_tcb_no_ctes, assumption) apply (rule ball_tcb_cte_casesI, simp_all)[1] apply (simp add: cep_relations_drop_fun_upd) apply (erule cmap_relation_updI, erule ko_at_projectKO_opt) apply (simp add: ctcb_relation_def cthread_state_relation_def
                                           "StrictC'_thread_state_defs") apply (clarsimp simp: ccap_relation_ep_helpers) apply simp apply (rule conjI, erule cready_queues_relation_not_queue_ptrs) apply (rule ext, simp split: if_split) apply (rule ext, simp split: if_split) apply (simp add: carch_state_relation_def cmachine_state_relation_def
                                         typ_heap_simps' map_comp_update projectKO_opt_tcb
                                         cvariable_relation_upd_const ko_at_projectKO_opt) apply ceqv apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2) apply (rule_tac xf'=xfdc and r'=dc in ccorres_split_nothrow) apply (rule fastpath_enqueue_ccorres[simplified]) apply simp apply ceqv apply (simp add: liftM_def del: Collect_const cong: call_ignore_cong) apply (rule ccorres_move_c_guard_tcb_ctes3) apply (rule_tac r'="\<lambda>rv rv'. rv' = mdbPrev (cteMDBNode rv)"
                                    and xf'=ret__unsigned_' in ccorres_split_nothrow) apply (rule_tac P="tcb_at' curThread
                                            and K (curThread = ksCurThread_y)
                                            and (\<lambda>s. ksCurThread s = ksCurThread_y)"
                                         in getCTE_ccorres_helper[where P'=UNIV]) apply (rule conseqPre, vcg) apply (clarsimp simp: typ_heap_simps' cte_level_bits_def
                                                  tcbCallerSlot_def size_of_def
                                                  tcb_cnode_index_defs) apply (clarsimp simp: ccte_relation_def map_option_Some_eq2) apply ceqv apply (rule ccorres_assert) apply (rename_tac mdbPrev_cte mdbPrev_cte_c) apply (rule ccorres_split_nothrow_dc) apply (simp add: updateMDB_def Let_def
                                         del: Collect_const cong: if_cong) apply (rule_tac P="cte_wp_at' ((=) mdbPrev_cte)
                                                  (curThread + (tcbCallerSlot << cte_level_bits))
                                                   and valid_mdb'"
                                         in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cte_wp_at_ctes_of) apply (drule(2) valid_mdb_ctes_of_prev[rotated]) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule cmap_relationE1[OF cmap_relation_cte], assumption+) apply (clarsimp simp: typ_heap_simps' split_def) apply (rule getCTE_setCTE_rf_sr, simp_all)[1] apply (clarsimp simp: ccte_relation_def map_option_Some_eq2
                                                   cte_to_H_def mdb_node_to_H_def
                                                   c_valid_cte_def) apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2,
                                   rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_dc) apply (rule_tac P="cte_at' (curThread + (tcbCallerSlot << cte_level_bits))
                                                     and tcb_at' curThread
                                                     and K (curThread = ksCurThread_y)"
                                          in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule cmap_relationE1[OF cmap_relation_cte], assumption+) apply (clarsimp simp: typ_heap_simps' split_def tcbCallerSlot_def
                                                     tcb_cnode_index_defs
                                                     cte_level_bits_def size_of_def
                                                     packed_heap_update_collapse_hrs) apply (rule setCTE_rf_sr, simp_all add: typ_heap_simps')[1] apply (clarsimp simp: ccte_relation_eq_ccap_relation makeObject_cte
                                                     mdb_node_to_H_def nullMDBNode_def
                                                     ccap_relation_NullCap_iff) apply csymbr apply (ctac add: fastpath_copy_mrs_ccorres[unfolded forM_x_def]) apply (rule_tac r'=dc and xf'=xfdc in ccorres_split_nothrow) apply (simp add: setThreadState_runnable_simp) apply (rule_tac P=\<top> in threadSet_ccorres_lemma2, vcg) apply (clarsimp simp: typ_heap_simps' rf_sr_def
                                                          cstate_relation_def Let_def) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def typ_heap_simps'
                                                           update_tcb_map_tos map_to_tcbs_upd) apply (subst map_to_ctes_upd_tcb_no_ctes, assumption) apply (rule ball_tcb_cte_casesI, simp_all)[1] apply (simp add: cep_relations_drop_fun_upd) apply (erule cmap_relation_updI, erule ko_at_projectKO_opt) apply (simp add: ctcb_relation_def cthread_state_relation_def) apply simp apply (rule conjI, erule cready_queues_relation_not_queue_ptrs) apply (rule ext, simp split: if_split) apply (rule ext, simp split: if_split) apply (simp add: carch_state_relation_def cmachine_state_relation_def
                                                     typ_heap_simps' map_comp_update projectKO_opt_tcb
                                                     cvariable_relation_upd_const ko_at_projectKO_opt) apply ceqv apply (simp only: bind_assoc[symmetric]) apply (rule ccorres_stateAssert_after) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_call,
                                             rule_tac v=shw_asid and pd="capUntypedPtr (cteCap pd_cap)"
                                                   in switchToThread_fp_ccorres,
                                             simp+)[1] apply (rule_tac P="\<lambda>s. ksCurThread s = capTCBPtr (cteCap caller_cap)"
                                                  in ccorres_cross_over_guard) apply csymbr apply csymbr apply (rule ccorres_call_hSkip) apply (rule fastpath_restore_ccorres) apply simp apply simp apply (simp add: setCurThread_def) apply wp apply (rule_tac P=\<top> in hoare_triv, simp) apply simp apply (simp add: imp_conjL rf_sr_ksCurThread del: all_imp_to_ex) apply (clarsimp simp: ccap_relation_ep_helpers guard_is_UNIV_def
                                                        mi_from_H_def) apply (simp add: pd_has_hwasid_def) apply (wp sts_valid_objs') apply (simp del: Collect_const) apply (vcg exspec=thread_state_ptr_set_tsType_np_modifies) apply simp apply (rule mapM_x_wp'[OF hoare_weaken_pre], wp) apply clarsimp apply simp apply (vcg exspec=fastpath_copy_mrs_modifies) apply (simp add: valid_tcb_state'_def) apply wp apply (wp setCTE_cte_wp_at_other) apply (simp del: Collect_const) apply vcg apply simp apply (wp | simp
                                      | wp (once) updateMDB_weak_cte_wp_at
                                      | wp (once) updateMDB_cte_wp_at_other)+ apply (vcg exspec=mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_modifies) apply simp apply (wp getCTE_wp') apply simp apply vcg apply (simp add: shiftl_t2n) apply (wp hoare_drop_imps setEndpoint_valid_mdb' set_ep_valid_objs'
                              setObject_no_0_obj'[where 'a=endpoint, folded setEndpoint_def]) apply simp apply (vcg exspec=endpoint_ptr_mset_epQueue_tail_state_modifies
                                 exspec=endpoint_ptr_set_epQueue_head_np_modifies
                                 exspec=endpoint_ptr_get_epQueue_tail_modifies) apply (simp add: valid_pspace'_def pred_conj_def conj_comms
                                      valid_mdb'_def) apply (wp threadSet_cur threadSet_tcbState_valid_objs
                               threadSet_state_refs_of' threadSet_ctes_of
                               valid_ep_typ_at_lift' threadSet_cte_wp_at'
                                  | simp)+ apply (vcg exspec=thread_state_ptr_mset_blockingObject_tsType_modifies) apply simp apply (rule threadGet_wp) apply simp apply wp[1] apply clarsimp apply (wp (once) hoare_drop_imp) apply wp apply (wp (once) hoare_drop_imps) apply wp apply (simp del: Collect_const) apply clarsimp apply (vcg exspec=isHighestPrio_modifies) apply (wp cd_wp) apply (simp cong: if_cong) apply (simp cong: if_cong) apply vcg apply (simp add: syscall_from_H_def del: Collect_const) apply (vcg exspec=cap_page_directory_cap_get_capPDBasePtr_spec2) apply (rule conseqPre,
                      vcg exspec=cap_page_directory_cap_get_capPDBasePtr_spec2,
                      clarsimp) apply (simp add:ccap_relation_reply_helper cong:if_cong) apply (rule threadGet_wp) apply (simp add: syscall_from_H_def ccap_relation_reply_helper) apply (vcg exspec=seL4_Fault_get_seL4_FaultType_modifies) apply simp apply wp apply simp apply (vcg exspec=fastpath_reply_cap_check_modifies) apply simp apply (rule getEndpoint_wp) apply (simp add: syscall_from_H_def ccap_relation_reply_helper) apply (vcg exspec=endpoint_ptr_get_state_modifies) apply simp apply (wp option_case_liftM_getNotification_wp[unfolded fun_app_def]) apply (simp del: Collect_const) apply vcg apply (simp add: if_1_0_0 getSlotCap_def) apply (rule valid_isLeft_theRight_split) apply (wp getCTE_wp') apply (rule validE_R_abstract_rv) apply wp apply (simp del: Collect_const) apply (vcg exspec=lookup_fp_modifies) apply simp apply (rule threadGet_wp) apply (simp del: Collect_const) apply vcg apply simp apply (rule user_getreg_wp) apply simp apply (rule user_getreg_wp) apply (rule conjI) apply (clarsimp simp: ct_in_state'_def obj_at_tcbs_of word_sle_def) apply (clarsimp simp add: invs_ksCurDomain_maxDomain') apply (rule conjI, fastforce) apply (frule invs_queues) apply (simp add: valid_queues_def) apply (frule tcbs_of_aligned') apply (simp add:invs_pspace_aligned') apply (frule tcbs_of_cte_wp_at_caller) apply (clarsimp simp:size_of_def field_simps
        dest!:ptr_val_tcb_ptr_mask2[unfolded mask_def]) apply (frule st_tcb_at_state_refs_ofD') apply (clarsimp simp: obj_at_tcbs_of ct_in_state'_def st_tcb_at_tcbs_of
                           invs_cur' invs_valid_objs' ctes_of_valid'
                           fun_upd_def[symmetric] fun_upd_idem pred_tcb_at'_def invs_no_0_obj') apply (frule cte_wp_at_valid_objs_valid_cap', clarsimp) apply (clarsimp simp: isCap_simps valid_cap'_def[split_simps capability.split]
                           maskCapRights_def cte_wp_at_ctes_of cte_level_bits_def) apply (frule_tac p = a in ctes_of_valid',clarsimp) apply (simp add:valid_cap_simps') apply (clarsimp simp:cte_level_bits_def) apply (frule_tac p="p + tcbCallerSlot * cte_size"for p cte_size in ctes_of_valid', clarsimp) apply (clarsimp simp: valid_capAligned) apply (frule_tac ptr2 = v0a in tcbs_of_cte_wp_at_vtable) apply (frule_tac ptr2 = v0a in tcbs_of_aligned') apply (simp add:invs_pspace_aligned') apply (clarsimp simp:size_of_def field_simps cte_wp_at_ctes_of
       word_sle_def word_sless_def
       dest!:ptr_val_tcb_ptr_mask2[unfolded mask_def]) apply (clarsimp simp: valid_cap_simps' obj_at_tcbs_of) apply (frule_tac p="p + tcbVTableSlot * cte_size" for p cte_size in ctes_of_valid', clarsimp) apply (clarsimp simp: isCap_simps valid_cap_simps' capAligned_def
                           invs_valid_pde_mappings' obj_at_tcbs_of
                    dest!: isValidVTableRootD) apply (frule invs_mdb') apply (clarsimp simp: cte_wp_at_ctes_of tcbSlots cte_level_bits_def
                           makeObject_cte isValidVTableRoot_def
                           ARM_H.isValidVTableRoot_def
                           pde_stored_asid_def to_bool_def
                           valid_mdb'_def valid_tcb_state'_def
                           word_le_nat_alt[symmetric] length_msgRegisters) apply (frule ko_at_valid_ep', fastforce) apply (rule conjI) subgoal  (* dest thread domain \<le> maxDomain *)
        by (drule (1) tcbs_of_valid_tcb'[OF invs_valid_objs'], solves \<open>clarsimp simp: valid_tcb'_def\<close>) apply clarsimp apply (safe del: notI disjE)[1] apply (simp add: isSendEP_def valid_ep'_def tcb_at_invs'
                 split: Structures_H.endpoint.split_asm) apply (rule subst[OF endpoint.sel(1)],
              erule st_tcb_at_not_in_ep_queue[where P="(=) Running", rotated],
              clarsimp+) apply (simp add: obj_at_tcbs_of st_tcb_at_tcbs_of) apply (drule invs_sym') apply (erule_tac  P=sym_refs in subst[rotated]) apply (rule fun_upd_idem[symmetric]) apply (clarsimp simp: tcb_bound_refs'_def) apply (case_tac ntfnptr, simp_all)[1] apply (clarsimp simp: set_eq_subset) apply (clarsimp simp: field_simps) apply (clarsimp simp: syscall_from_H_def[split_simps syscall.split]
                          word_sle_def word_sless_def rf_sr_ksCurThread
                          ptr_val_tcb_ptr_mask' size_of_def cte_level_bits_def
                          tcb_cnode_index_defs tcbSlots
                simp del: Collect_const) apply (frule obj_at_bound_tcb_grandD, clarsimp, clarsimp, simp) apply (clarsimp simp: typ_heap_simps if_1_0_0) apply (clarsimp simp: ccte_relation_eq_ccap_relation
                          if_1_0_0 ccap_relation_case_sum_Null_endpoint
                          isRight_case_sum typ_heap_simps'
                          pdBits_def pageBits_def pdeBits_def
                          cap_get_tag_isCap mi_from_H_def) apply (intro conjI impI allI
           ; clarsimp simp: isCap_simps capAligned_def objBits_simps' ccap_relation_pd_helper
                            cap_get_tag_isCap_ArchObject2 pdeBits_def typ_heap_simps isRight_def
                     dest!: ptr_val_tcb_ptr_mask2[unfolded objBits_def mask_def, simplified]
                            isValidVTableRootD
                     split: sum.splits) apply (clarsimp simp: ctcb_relation_def)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. Kernel_C.tcbCaller = SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot proof (state)
this:
Kernel_C.tcbCaller = SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot

goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. Kernel_C.tcbVTable = SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot proof (state)
this:
Kernel_C.tcbVTable = SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot

goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb ptr. tcbs_of s ptr = Some tcb \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (ptr + 0x10 * tcbVTableSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb; \<forall>n\<in>dom tcb_cte_cases. \<not> tcb_at' (ptr + 0x10 * tcbVTableSlot - n) s\<rbrakk> \<Longrightarrow> real_cte_at' (ptr + 0x10 * tcbVTableSlot) s proof (prove)
goal (2 subgoals):
 1. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb\<rbrakk> \<Longrightarrow> 0x10 * tcbVTableSlot \<in> dom tcb_cte_cases
 2. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb; \<not> tcb_at' (ptr + 0x10 * tcbVTableSlot - 0x10 * tcbVTableSlot) s\<rbrakk> \<Longrightarrow> real_cte_at' (ptr + 0x10 * tcbVTableSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb; \<not> tcb_at' (ptr + 0x10 * tcbVTableSlot - 0x10 * tcbVTableSlot) s\<rbrakk> \<Longrightarrow> real_cte_at' (ptr + 0x10 * tcbVTableSlot) s proof (prove)
goal:
No subgoals! proof (state)
this:
tcbs_of ?s2 ?ptr2 = Some ?tcb2 \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (?ptr2 + 0x10 * tcbVTableSlot) ?s2

goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb ptr. tcbs_of s ptr = Some tcb \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (ptr + 0x10 * tcbCallerSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb; \<forall>n\<in>dom tcb_cte_cases. \<not> tcb_at' (ptr + 0x10 * tcbCallerSlot - n) s\<rbrakk> \<Longrightarrow> real_cte_at' (ptr + 0x10 * tcbCallerSlot) s proof (prove)
goal (2 subgoals):
 1. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb\<rbrakk> \<Longrightarrow> 0x10 * tcbCallerSlot \<in> dom tcb_cte_cases
 2. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb; \<not> tcb_at' (ptr + 0x10 * tcbCallerSlot - 0x10 * tcbCallerSlot) s\<rbrakk> \<Longrightarrow> real_cte_at' (ptr + 0x10 * tcbCallerSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s tcb ptr. \<lbrakk>tcb_at' ptr s; projectKO_opt (the (ksPSpace s ptr)) = Some tcb; \<not> tcb_at' (ptr + 0x10 * tcbCallerSlot - 0x10 * tcbCallerSlot) s\<rbrakk> \<Longrightarrow> real_cte_at' (ptr + 0x10 * tcbCallerSlot) s proof (prove)
goal:
No subgoals! proof (state)
this:
tcbs_of ?s2 ?ptr2 = Some ?tcb2 \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (?ptr2 + 0x10 * tcbCallerSlot) ?s2

goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s ptr tcb. \<lbrakk>tcbs_of s ptr = Some tcb; pspace_aligned' s\<rbrakk> \<Longrightarrow> is_aligned ptr tcbBlockSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>s ptr tcb ko obj. \<lbrakk>pspace_aligned' s; ksPSpace s ptr = Some ko; is_aligned ptr (objBitsKO ko); ps_clear ptr (objBitsKO ko) s; fst (projectKO ko s) = {(obj, s)}; projectKO_opt ko = Some tcb\<rbrakk> \<Longrightarrow> is_aligned ptr tcbBlockSizeBits proof (prove)
goal (2 subgoals):
 1. \<And>s ptr tcb ko obj. \<lbrakk>pspace_aligned' s; is_aligned ptr (objBitsKO ko); ps_clear ptr (objBitsKO ko) s; fst (projectKO ko s) = {(obj, s)}; projectKO_opt ko = Some tcb\<rbrakk> \<Longrightarrow> pspace_aligned' s
 2. \<And>s ptr tcb ko obj. \<lbrakk>pspace_aligned' s; is_aligned ptr (objBitsKO ko); ps_clear ptr (objBitsKO ko) s; fst (projectKO ko s) = {(obj, s)}; projectKO_opt ko = Some tcb; is_aligned ptr (objBitsKO ko)\<rbrakk> \<Longrightarrow> is_aligned ptr tcbBlockSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>s ptr tcb ko obj. \<lbrakk>pspace_aligned' s; ps_clear ptr (objBitsKO ko) s; fst (projectKO ko s) = {(obj, s)}; projectKO_opt ko = Some tcb; is_aligned ptr (objBitsKO ko)\<rbrakk> \<Longrightarrow> is_aligned ptr tcbBlockSizeBits proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>tcbs_of ?s2 ?ptr2 = Some ?tcb2; pspace_aligned' ?s2\<rbrakk> \<Longrightarrow> is_aligned ?ptr2 tcbBlockSizeBits

goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (state)
this:
\<lbrakk>tcbs_of ?s2 ?ptr2 = Some ?tcb2; pspace_aligned' ?s2\<rbrakk> \<Longrightarrow> is_aligned ?ptr2 tcbBlockSizeBits

goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>msgInfo cptra. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6569 msgInfo cptra) (?Q'6569 msgInfo cptra) [SKIP] (doE curThread <- liftE getCurThread;
mi <- liftE (getMessageInfo curThread);
cptr <- liftE (asUser curThread (getRegister Thread_H.capRegister));
fault <- liftE (threadGet tcbFault curThread);
pickFastpath <- liftE (return True \<sqinter> return False);
y <- unlessE (fault = None \<and> msgExtraCaps mi = 0 \<and> msgLength mi \<le> word_of_nat size_msgRegisters \<and> pickFastpath) (throwError ());
ctab <- liftE (getThreadCSpaceRoot curThread >>= getCTE);
epCap <- unifyFailure (doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE);
y <- unlessE (isEndpointCap epCap \<and> capEPCanReceive epCap) (throwError ());
bound_ntfn <- liftE (getBoundNotification curThread);
active_ntfn <- liftE (case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr));
y <- unlessE (\<not> active_ntfn) (throwError ());
ep <- liftE (getEndpoint (capEPPtr epCap));
y <- unlessE (\<not> isSendEP ep) (throwError ());
callerSlot <- liftE (getThreadCallerSlot curThread);
callerCTE <- liftE (getCTE callerSlot);
y <- unlessE (isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE)) (throwError ());
callerFault <- liftE (threadGet tcbFault (capTCBPtr (cteCap callerCTE)));
y <- unlessE (callerFault = None) (throwError ());
newVTable <- liftE (getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE);
y <- unlessE (isValidVTableRoot (cteCap newVTable)) (throwError ());
curDom <- liftE curDomain;
callerPrio <- liftE (threadGet tcbPriority (capTCBPtr (cteCap callerCTE)));
highest <- liftE (isHighestPrio curDom callerPrio);
y <- unlessE highest (throwError ());
asidMap <- liftE (gets (armKSASIDMap \<circ> ksArchState));
y <- unlessE (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v}) (throwError ());
callerDom <- liftE (threadGet tcbDomain (capTCBPtr (cteCap callerCTE)));
y <- unlessE (callerDom = curDom) (throwError ());
liftE (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr epCap) (capEPCanGrant epCap))) curThread;
y <- setEndpoint (capEPPtr epCap) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength mi)) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) mi)]);
stateAssert kernelExitAssertions []
od)
odE <catch> (\<lambda>_. callKernel (SyscallEvent syscall.SysReplyRecv))) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>msgInfo cptra. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6569 msginfo cptr) (?Q'6569 msginfo cptr) [SKIP] (do curThread <- getCurThread;
x <- asUser curThread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser curThread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>msgInfo cptra curThread. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P6622 msginfo cptr a curThread) (?P'6623 msginfo cptr curThread) [SKIP] (do x <- asUser curThread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser curThread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>msgInfo cptra curThread. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P6622 msginfo cptr a curThread) (?P'6623 msginfo cptr curThread) [SKIP] (do x <- asUser curThread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser curThread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 2 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread rv rva. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6645 msgInfo cptra curThread rv rva) (?Q'6656 msginfo cptr curThread rv rva) [SKIP] (do fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rva <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) rva (size rva);
liftE (getSlotCap (fst t))
odE;
if isRight rva then if isEndpointCap (theRight rva) \<and> capEPCanReceive (theRight rva) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rva));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rva)) (capEPCanGrant (theRight rva)))) curThread;
y <- setEndpoint (capEPPtr (theRight rva)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord rv))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord rv))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' cptr'. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6645 msgInfo cptra curThread msginfo' cptr') (?Q'6656 msginfo cptr curThread msginfo' cptr') [SKIP] (do fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr' (size cptr');
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo'))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo'))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' cptr'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo \<and> cptr' = cptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G6660 msgInfo cptra curThread msginfo' cptr') (?Q'6656 msginfo cptr curThread msginfo' cptr') [SKIP] (do fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr' (size cptr');
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo'))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo'))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G6660 msginfo cptr curThread msginfo cptr) (?Q'6656 msginfo cptr curThread msginfo cptr) [SKIP] (do fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msgInfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msgInfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptra);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G6660 msginfo cptr curThread msginfo cptr) (?Q'6656 msginfo cptr curThread msginfo cptr) [SKIP] (do fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>info :== CALL messageInfoFromWord_raw_'proc(msginfo);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msginfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G6660 msginfo cptr curThread msginfo cptr) (?G'8682 msginfo cptr curThread msginfo cptr info ret__unsigned) [SKIP] (do fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>length___unsigned_long :== ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msginfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G6660 msginfo cptr curThread msginfo cptr) (?G'8682 msginfo cptr curThread msginfo cptr info ret__unsigned) [SKIP] (do fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>length___unsigned_long :== ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msginfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 4 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>ft ft'. (ft' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (ft = None)) ret__unsigned_' (?P9076 msginfo cptr curThread msginfo cptr) (?P'9069 msginfo cptr curThread msginfo cptr info ret__unsigned) [SKIP] (threadGet tcbFault curThread) (\<acute>length___unsigned_long :== ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C''])))))
A total of 8 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cur_tcb' and (\<lambda>s. curThread = ksCurThread s)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>length___unsigned_long :== ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C''])))) {s. \<exists>(rv, \<sigma>')\<in>fst (threadGet tcbFault curThread \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)}
A total of 8 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned \<sigma>. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> {s. (cur_tcb' and (\<lambda>s. curThread = ksCurThread s)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<and> (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (threadGet tcbFault curThread \<sigma>). (\<sigma>', s\<lparr>length___unsigned_long_' := ret__unsigned, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr \<and> (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)))}
A total of 8 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>tcb_at' (ksCurThread \<sigma>) \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ((\<exists>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbFault_C''])))) \<longrightarrow> (\<exists>xa\<in>fst (threadGet tcbFault (ksCurThread \<sigma>) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)))
A total of 8 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko ko'. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ((\<exists>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbFault_C''])))) \<longrightarrow> (\<exists>xa\<in>fst (threadGet tcbFault (ksCurThread \<sigma>) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)))
A total of 8 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko ko' cf' t. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; seL4_Fault_lift (tcbFault_C ko') = Some cf'; if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C ko') = Some lf' \<and> fault_to_H cf' lf' = tcbFault ko else fault_to_H cf' undefined = tcbFault ko; ret__unsigned_' t = seL4_Fault_get_tag (tcbFault_C ko')\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (threadGet tcbFault (ksCurThread \<sigma>) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (seL4_Fault_get_tag (tcbFault_C ko') = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)
A total of 8 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko ko' cf' t. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; seL4_Fault_lift (tcbFault_C ko') = Some cf'; if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C ko') = Some lf' \<and> fault_to_H cf' lf' = tcbFault ko else fault_to_H cf' undefined = tcbFault ko; ret__unsigned_' t = seL4_Fault_get_tag (tcbFault_C ko')\<rbrakk> \<Longrightarrow> case (tcbFault ko, \<sigma>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (seL4_Fault_get_tag (tcbFault_C ko') = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)
A total of 8 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' t t'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>fault_type :== \<acute>ret__unsigned;;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msginfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))))) (?d'9060 msgInfo cptra curThread msginfo' info ret__unsigned rv')
A total of 7 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9060 msgInfo cptra curThread msginfo' info ret__unsigned rv) (?Q'9060 msgInfo cptra curThread msginfo' info ret__unsigned rv rv') [SKIP] ((if rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>fault_type :== rv';;
(\<acute>ret__int :== CALL fastpath_mi_check_'proc(msginfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9060 msgInfo cptra curThread msginfo' info ret__unsigned rv) (?G'9811 msgInfo cptra curThread msginfo' info ret__unsigned rv rv') [SKIP] ((if rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__int :== CALL fastpath_mi_check_'proc(msginfo);;
(IF \<acute>ret__int = 0 \<longrightarrow> rv' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9060 msgInfo cptra curThread msginfo' info ret__unsigned rv) (?G'10723 msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int) [SKIP] ((if rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__int = 0 \<longrightarrow> rv' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(info,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9060 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?G'10723 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] ((if rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)) (IF msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11153 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?S11156 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] ((if rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 7 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11153 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?S11156 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 7 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11153 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?P'11173 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 8 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11153 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?C'11182 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 10 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int s ta sa. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None\<rbrakk> \<Longrightarrow> globals sa = globals sa
A total of 9 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int s. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None\<rbrakk> \<Longrightarrow> globals (syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s) = globals s
A total of 8 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11172 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 7 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); \<not> (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11152 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?T11154 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] ((if rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) \<sqinter> callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); \<not> (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11152 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?T11154 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] (if rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters then do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); \<not> (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None); \<not> (rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R11217 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?T11219 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 7 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); \<not> (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None); \<not> (rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 7 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))); (rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None); (ret__int = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)); \<not> (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> rv \<noteq> None); rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11218 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv) (?S11221 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))) rv rv' ret__int) [SKIP] (do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11218 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None) (?S11221 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0) [SKIP] (do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11218 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None) (?S11221 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0) [SKIP] (do ctab <- getThreadCSpaceRoot curThread >>= getCTE;
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11218 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None) (?S11221 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0) [SKIP] (do ctab <- getCTE (curThread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P11252 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None a ctab) (?P'11253 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab) [SKIP] (do rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val \<acute>ksCurThread && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G11259 curThread ctab ct) (?G'11261 curThread ctab ct) [SKIP] (do rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals...
flex-flex pairs:
\<lambda>curThread ctab s. ?G'11261 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?G'11258 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0
\<lambda>curThread. ?P11260 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?G11259 curThread ctab (ksCurThread s) s proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A11827 curThread ctab ct) (?C'11825 curThread ctab ct) [SKIP] (do rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(\<acute>ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 6 subgoals...
flex-flex pairs:
\<lambda>curThread ctab s. ?C'11825 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?C'11824 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0
\<lambda>curThread. ?A11828 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?A11827 curThread ctab (ksCurThread s) proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct rv ep_cap. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11838 msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct rv) (?Q'11838 msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct rv ep_cap) [SKIP] (if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct luRet ep_cap. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q11838 msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct luRet) (?Q'11838 msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct luRet ep_cap) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct luRet ep_cap cta. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G14079 msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct luRet cta) (?G'14078 msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct luRet ep_cap cta) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct luRet ep_cap cta. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A14554 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?C'14551 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__int :== CALL cap_capType_equals_'proc(ep_cap,SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap);;
(\<acute>ret__int :== (if \<acute>ret__int = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = of_bl [cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A14554 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?G'14915 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta ret__int) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF (if ret__int = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A14554 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?G'14915 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF isLeft luRet \<or> \<not> isEndpointCap (theRight luRet) THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q15288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?S15291 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q15288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?S15291 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q15288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?R'15304 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q15288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?P'15310 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q15288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?C'15319 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (11 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int x y s. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> globals s = globals s
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int s. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> globals (syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s) = globals s
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15309 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); \<not> (isLeft luRet \<or> \<not> isEndpointCap (theRight luRet))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R15287 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?T15289 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__inta ctab ct luRet ep_cap cta ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); \<not> (isLeft luRet \<or> \<not> isEndpointCap (theRight luRet))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R15287 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?T15289 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)))) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(ep_cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (case luRet of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) ep_cap; ret__int = from_bool (isRight luRet \<and> isEndpointCap (theRight luRet)); \<not> (isLeft luRet \<or> \<not> isEndpointCap (theRight luRet)); ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift ep_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R15287 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?G'15833 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta (from_bool (isRight luRet \<and> isEndpointCap (theRight luRet))) ret__unsigned) [SKIP] (if isRight luRet then if isEndpointCap (theRight luRet) \<and> capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv) else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF (if ret__unsigned = 0 then 1 else 0) \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; isRight luRet \<and> isEndpointCap (theRight luRet); ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift ep_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R15287 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?G'15833 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (capCanReceive_CL (cap_endpoint_cap_lift ep_cap))) [SKIP] (if capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF capCanReceive_CL (cap_endpoint_cap_lift ep_cap) = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift ep_cap); isRight luRet; isEndpointCap (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R15287 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?G'15833 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (capCanReceive_CL (cap_endpoint_cap_lift ep_cap))) [SKIP] (if capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF capCanReceive_CL (cap_endpoint_cap_lift ep_cap) = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift ep_cap); isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R15287 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?G'15833 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (capCanReceive_CL (cap_endpoint_cap_lift ep_cap))) [SKIP] (if capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF capCanReceive_CL (cap_endpoint_cap_lift ep_cap) = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = from_bool (capEPCanReceive (theRight luRet)); isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R15287 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?G'15833 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (from_bool (capEPCanReceive (theRight luRet)))) [SKIP] (if capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF \<not> capEPCanReceive (theRight luRet) THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = from_bool (capEPCanReceive (theRight luRet)); isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16210 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?S16213 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (from_bool (capEPCanReceive (theRight luRet)))) [SKIP] (if capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) false; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16210 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?S16213 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) false; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16210 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?P'16223 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) false; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16210 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?C'16232 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (11 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned x y s. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) false; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> globals s = globals s
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned s. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) false; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> globals (syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s) = globals s
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) false; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16222 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) false)) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = from_bool (capEPCanReceive (theRight luRet)); isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<not> \<not> capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R16209 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?T16211 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (from_bool (capEPCanReceive (theRight luRet)))) [SKIP] (if capEPCanReceive (theRight luRet) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R16209 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet cta) (?T16211 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P16260 curThread ctab ct luRet cta bound_ntfn) (?P'16259 curThread ctab ct luRet ep_cap cta bound_ntfn) [SKIP] (do active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet cta s tcb. ?P16260 curThread ctab ct luRet cta (tcbBoundNotification tcb) s \<equiv>\<^sup>? \<lambda>curThread. ?P16257 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?P'16259 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?P'16258 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P16260 curThread ctab ct luRet cta bound_ntfn) (?P'16259 curThread ctab ct luRet ep_cap cta bound_ntfn) [SKIP] (do active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))))
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet cta s tcb. ?P16260 curThread ctab ct luRet cta (tcbBoundNotification tcb) s \<equiv>\<^sup>? \<lambda>curThread. ?P16257 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?P'16259 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?P'16258 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = from_bool rv) ret__int_' (?P16287 curThread ctab ct luRet cta bound_ntfn) (?P'16283 curThread ctab ct luRet ep_cap cta bound_ntfn) [SKIP] (case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?P'16283 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?P'16281 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread ctab ct luRet cta tcb. ?P16287 curThread ctab ct luRet cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread. ?P16289 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0
\<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (bound_tcb_at' ((=) bound_ntfn) curThread and valid_objs' and no_0_obj' and (\<lambda>s. curThread = ksCurThread s)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI {s. \<exists>(rv, \<sigma>')\<in>fst ((case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__int_' s = from_bool rv}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn \<sigma>. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> {s. (bound_tcb_at' ((=) bound_ntfn) curThread and valid_objs' and no_0_obj' and (\<lambda>s. curThread = ksCurThread s)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<and> ((if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<and> s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr)) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))), ret__int_' := if notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0\<rparr>) \<in> rf_sr \<and> (if notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv))) \<and> ((if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0) = 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr)) \<sigma>). (\<sigma>', s\<lparr>ret__int_' := 0\<rparr>) \<in> rf_sr \<and> 0 = from_bool rv))}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>luRet ep_cap bound_ntfn \<sigma> x. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); obj_at' (\<lambda>ko. bound_ntfn = tcbBoundNotification ko) (ksCurThread \<sigma>) \<sigma>; valid_objs' \<sigma>; no_0_obj' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbBoundNotification_C''])) \<and> ((\<exists>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift x (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbBoundNotification_C'']))))))) \<longrightarrow> (\<exists>xa\<in>fst ((case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (if notification_CL.state_CL (notification_lift (the (cslift x (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<exists>xa\<in>fst ((case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> from_bool rv = 0))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>luRet ep_cap \<sigma> x tcb tcb' ntfn ntfn' y t. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); valid_objs' \<sigma>; no_0_obj' \<sigma>; (\<sigma>, x) \<in> rf_sr; ko_at' tcb (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some tcb'; ctcb_relation tcb tcb'; tcbBoundNotification_C tcb' \<noteq> NULL; ko_at' ntfn y \<sigma>; cslift x (tcbBoundNotification_C tcb') = Some ntfn'; cnotification_relation (cslift x) ntfn ntfn'; tcbBoundNotification tcb = Some y; ret__unsigned_' t = notification_CL.state_CL (notification_lift ntfn')\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (liftM EndpointDecls_H.isActive (getNotification y) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (if notification_CL.state_CL (notification_lift ntfn') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (11 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv'a t t'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))) (?d'16266 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv'a)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = from_bool rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16266 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv) (?Q'16266 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a) [SKIP] (if \<not> rv then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF rv'a \<noteq> 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = from_bool rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16266 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv) (?Q'16266 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv (from_bool rv)) [SKIP] (if \<not> rv then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF \<not> \<not> rv THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (11 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = from_bool rv; \<not> \<not> rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16883 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv) (?S16886 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv (from_bool rv)) [SKIP] (if \<not> rv then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = from_bool rv; \<not> \<not> rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16883 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv) (?P'16894 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv (from_bool rv)) [SKIP] (if \<not> rv then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = true; rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16883 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn True) (?P'16894 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn True true) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = true; rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16883 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn True) (?C'16905 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn True true) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (11 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = true; rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16893 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn True true) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = from_bool rv; \<not> \<not> \<not> rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R16882 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv) (?T16884 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn rv (from_bool rv)) [SKIP] (if \<not> rv then do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))))))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn rv rv'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R16882 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False) (?T16884 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false) [SKIP] (do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(ep_cap);;
(\<acute>ep_ptr :== ep_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(\<acute>ep_ptr);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val \<acute>ep_ptr,SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(\<acute>ep_ptr);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(\<acute>ep_ptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift ep_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R16882 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False) (?G'17264 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false ret__unsigned) [SKIP] (do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr ret__unsigned);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R16882 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False) (?G'17264 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))) [SKIP] (do ep <- getEndpoint (capEPPtr (theRight luRet));
if \<not> isSendEP ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr ret__unsigned);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))))
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>ep v. (v = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP ep) ret__unsigned_' (?P19078 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False) (?P'19071 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))) [SKIP] (getEndpoint (capEPPtr (theRight luRet))) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr ret__unsigned))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>ep v. (v = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP ep) ret__unsigned_' (?P19078 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False) (?P'19071 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))) [SKIP] (getEndpoint (capEPPtr (theRight luRet)) >>= return) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr ret__unsigned))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned ep. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>ep v. (v = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP ep) ret__unsigned_' (\<lambda>a. ?P19089 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False a ep) (?P'19087 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) ep) [SKIP] (return ep) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr ret__unsigned))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned ep. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (ko_at' ep (capEPPtr (theRight luRet)) and valid_objs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr ret__unsigned) {s. \<exists>(rv, \<sigma>')\<in>fst (return ep \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned ep \<sigma>. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> {s. (ko_at' ep (capEPPtr (theRight luRet)) and valid_objs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr ret__unsigned \<and> (\<forall>t. ret__unsigned_' t = endpoint_CL.state_CL (endpoint_lift (the (cslift s (ep_Ptr ret__unsigned)))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return ep \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := endpoint_CL.state_CL (endpoint_lift (the (cslift s (ep_Ptr ret__unsigned))))\<rparr>) \<in> rf_sr \<and> (endpoint_CL.state_CL (endpoint_lift (the (cslift s (ep_Ptr ret__unsigned)))) = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv))}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>luRet ep_cap rv ep \<sigma> x. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; ko_at' ep (capEPPtr (theRight luRet)) \<sigma>; valid_objs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr (capEPPtr (theRight luRet)) \<and> ((\<exists>t. ret__unsigned_' t = endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr (capEPPtr (theRight luRet))))))) \<longrightarrow> (endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr (capEPPtr (theRight luRet)))))) = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP ep)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>luRet ep_cap rv ep \<sigma> x y'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; ko_at' ep (capEPPtr (theRight luRet)) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) (capEPPtr (theRight luRet)) = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr (capEPPtr (theRight luRet))) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr (capEPPtr (theRight luRet)) \<and> ((\<exists>t. ret__unsigned_' t = endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr (capEPPtr (theRight luRet))))))) \<longrightarrow> (endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr (capEPPtr (theRight luRet)))))) = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP ep)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>luRet ep_cap rv ep \<sigma> x y' t. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; ko_at' ep (capEPPtr (theRight luRet)) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) (capEPPtr (theRight luRet)) = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr (capEPPtr (theRight luRet))) = Some y'; ret__unsigned_' t = endpoint_CL.state_CL (endpoint_lift y')\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP ep
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned rv'b t t'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))) (?d'19062 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned rv'b)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); (rv'b = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19062 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned rva) (?Q'19062 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned rva rv'b) [SKIP] (if \<not> isSendEP rva then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case rva of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF rv'b = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); (send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19062 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep) (?Q'19062 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send) [SKIP] (if \<not> isSendEP send_ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); (send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'19610 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep) (?Q19607 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send) [SKIP] (if \<not> isSendEP send_ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); (send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'19610 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep) (?Q19607 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send) [SKIP] (if \<not> isSendEP send_ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF isSendEP send_ep THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); (send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP send_ep; isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19621 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep) (?S19624 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send) [SKIP] (if \<not> isSendEP send_ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send; isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19621 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep) (?S19624 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep (SCAST(32 signed \<rightarrow> 32) EPState_Send)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send; isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19621 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep) (?P'19634 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep (SCAST(32 signed \<rightarrow> 32) EPState_Send)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send; isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19621 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep) (?C'19643 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep (SCAST(32 signed \<rightarrow> 32) EPState_Send)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send; isSendEP send_ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19633 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep (SCAST(32 signed \<rightarrow> 32) EPState_Send)) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); (send_ep_is_send = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP send_ep; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R19620 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep) (?T19622 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send) [SKIP] (if \<not> isSendEP send_ep then do callerSlot <- getThreadCallerSlot curThread;
callerCTE <- getCTE callerSlot;
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE callerSlot);
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE callerSlot makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R19620 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep) (?T19622 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send) [SKIP] (do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap callerCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>ksCurThread && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val \<acute>ksCurThread && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ctb. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G19663 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ctb) (?G'19664 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ctb) [SKIP] (do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap callerCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ctb) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ctb) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?G'19664 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?G'19662 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?G19663 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) s \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R19620 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G19663 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y) (?G'19664 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y) [SKIP] (do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap callerCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>callerSlot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?G'19664 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?G'19662 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?G19663 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) s \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R19620 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y) (?C'20039 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y) [SKIP] (do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap callerCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>callerSlot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?C'20039 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?C'20038 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?A20037 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rv'b t t'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (ksCurThread_' \<circ> globals) rv'b t t' (\<acute>callerSlot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))) (?g'20043 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rv'b)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?P'20047 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?P'20045 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?A20037 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rv'b t t' t'a. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> rewrite_xf (ksCurThread_' \<circ> globals) t rv'b (callerSlot_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))))) (?f'20061 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rv'b)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?P'20047 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?P'20045 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?A20037 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rv'b t t' t'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> callerSlot_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) t = ?f'20061 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y (ksCurThread_' (globals t)) t
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?P'20047 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?P'20045 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?A20037 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y) (?P'20047 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y) [SKIP] (do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap callerCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>callerSlot :== cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(\<acute>callerSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c callerSlot_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(\<acute>callerSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?P'20047 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?P'20045 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?A20037 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y) (?G'20091 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y) [SKIP] (do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap callerCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?G'20092 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?G'20091 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?A20041 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?A20037 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A21796 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y) (?C'21794 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y) [SKIP] (do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap callerCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>callerCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']));;
(\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?C'21794 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?C'21793 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?A21797 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?A21796 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y s f s'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> callerCap_' (callerCap_'_update f s) = f (callerCap_' s) \<and> ((s', callerCap_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?Q21812 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q21808 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?Q'21810 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q'21811 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rv'b t t'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep\<rbrakk> \<Longrightarrow> ceqv \<Gamma> callerCap_' rv'b t t' (\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(\<acute>callerCap);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(\<acute>callerCap);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))) (?g'21799 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rv'b)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?Q21812 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q21808 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q'21811 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?Q'21810 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap rva) rv'b; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?Q21812 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y a rva) (?Q'21810 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y rva rv'b) [SKIP] (if isReplyCap (cteCap rva) \<and> \<not> capReplyMaster (cteCap rva) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap rva));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap rva) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap rva));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap rva));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap rva)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap rva));
y <- Arch.switchToThread (capTCBPtr (cteCap rva));
y <- setCurThread (capTCBPtr (cteCap rva));
y <- asUser (capTCBPtr (cteCap rva)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(rv'b);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(rv'b);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?Q21812 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q21808 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q'21811 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?Q'21810 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?Q21812 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y a caller_cap) (?Q'21810 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c) [SKIP] (if isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(caller_cap_c);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?Q21812 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q21808 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q'21811 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?Q'21810 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'23466 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y caller_cap) (?Q23463 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c) [SKIP] (if isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(caller_cap_c);;
(IF \<acute>ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))))
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?P'23466 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?P'23467 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?Q23463 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?Q23464 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c rva ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; True; \<forall>cap. ccap_relation cap (?ccap23504 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c) \<longrightarrow> ret__int = from_bool (isReplyCap cap \<and> \<not> capReplyMaster cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q23476 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c rva) (?Q'23476 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c rva ret__int) [SKIP] (if isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?ccap23505 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?ccap23504 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c rva ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; True; ret__int = from_bool (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q23476 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c rva) (?Q'23476 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c rva ret__int) [SKIP] (if isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__int = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = from_bool (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q23476 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?Q'23476 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () (from_bool (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap)))) [SKIP] (if isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap) THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (15 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = from_bool (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap)); isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q25151 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?S25154 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () (from_bool (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap)))) [SKIP] (if isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (15 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = false; isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q25151 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?S25154 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () false) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = false; isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q25151 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?P'25167 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () false) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = false; isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q25151 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?C'25176 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () false) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (15 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = false; isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25166 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () false) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = from_bool (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap)); \<not> (isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R25150 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?T25152 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () (from_bool (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap)))) [SKIP] (if isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))))))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R25150 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?T25152 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () true) [SKIP] (do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(caller_cap_c);;
(\<acute>caller :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>caller\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (caller_' s) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val \<acute>caller && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val \<acute>caller && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>caller\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsigned),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsigned);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsigned,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,\<acute>caller);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c caller_' s} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(\<acute>caller\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(\<acute>caller,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R25150 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?G'25512 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () true ret__unsigned) [SKIP] (do callerFault <- threadGet tcbFault (capTCBPtr (cteCap caller_cap));
if callerFault = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>ft ft'. (ft' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (ft = None)) ret__unsigned_' (?P27065 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()) (?P'27058 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () true ret__unsigned) [SKIP] (threadGet tcbFault (capTCBPtr (cteCap caller_cap))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbFault_C''])))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned x. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbFault tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb' \<and> ctcb_relation tcb tcb'))} Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbFault_C''])))) {s. (\<sigma>, s) \<in> rf_sr \<and> (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (x = None)}
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned x \<sigma>. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbFault tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb' \<and> ctcb_relation tcb tcb'))} \<subseteq> {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned \<and> (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr \<and> (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (x = None))}
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c \<sigma> xa tcb tcb'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); (\<sigma>, xa) \<in> rf_sr; tcbs_of \<sigma> (capTCBPtr (cteCap caller_cap)) = Some tcb; cslift xa (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) \<and> ((\<exists>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(seL4_Fault_C) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbFault_C''])))) \<longrightarrow> (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(seL4_Fault_C) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (tcbFault tcb = None))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c \<sigma> xa tcb tcb' cf' t. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); (\<sigma>, xa) \<in> rf_sr; tcbs_of \<sigma> (capTCBPtr (cteCap caller_cap)) = Some tcb; cslift xa (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb'; cthread_state_relation (tcbState tcb) (tcbState_C tcb', tcbFault_C tcb'); tcbIPCBuffer tcb = tcbIPCBuffer_C tcb'; carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb'); tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))); UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb'; UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb'; UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb'; tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb'); option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; seL4_Fault_lift (tcbFault_C tcb') = Some cf'; if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf' \<and> fault_to_H cf' lf' = tcbFault tcb else fault_to_H cf' undefined = tcbFault tcb; ret__unsigned_' t = seL4_Fault_get_tag (tcbFault_C tcb')\<rbrakk> \<Longrightarrow> (seL4_Fault_get_tag (tcbFault_C tcb') = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (tcbFault tcb = None)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (17 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rv'b t t'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (\<acute>fault_type :== \<acute>ret__unsigned;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))) (?d'27049 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rv'b)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); (rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rva = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q27049 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva) (?Q'27049 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b) [SKIP] (if rva = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>fault_type :== rv'b;;
(IF \<acute>fault_type \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); (rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rva = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q27049 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva) (?G'27641 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b) [SKIP] (if rva = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_Ptr ret__unsigned) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); (rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rva = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q27049 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva) (?G'27641 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva rv'b) [SKIP] (if rva = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF rva \<noteq> None THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (17 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); (rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rva = None); rva \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q29105 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva) (?S29108 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva rv'b) [SKIP] (if rva = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (17 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q29105 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva) (?S29108 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva rv'b) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)));;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))))))))))))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q29105 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva) (?P'29118 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva rv'b) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q29105 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva) (?C'29127 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva rv'b) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (17 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; \<exists>y. rva = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'29117 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva rv'b) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); (rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rva = None); \<not> rva \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R29104 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva) (?T29106 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) rva rv'b) [SKIP] (if rva = None then do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R29104 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None) (?T29106 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault)) [SKIP] (do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00)) (sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A29163 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None) (?C'29160 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault)) [SKIP] (do newVTable <- getCTE (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>newVTable :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']));;
(\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b s f s'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None\<rbrakk> \<Longrightarrow> newVTable_' (newVTable_'_update f s) = f (newVTable_' s) \<and> ((s', newVTable_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (17 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b rv'c t t'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None\<rbrakk> \<Longrightarrow> ceqv \<Gamma> newVTable_' rv'c t t' (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(\<acute>newVTable);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(\<acute>newVTable);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))) (?g'29166 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b rv'c)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b rvb rv'c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap rvb) rv'c; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?Q29173 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None a rvb) (?Q'29174 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) rvb rv'c) [SKIP] (if isValidVTableRoot (cteCap rvb) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap rvb))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(rv'c);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(rv'c);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?Q29173 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None a pd_cap) (?Q'29174 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(pd_cap_c);;
(\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(pd_cap_c);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q30524 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?Q'30522 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>cap_pd :== pde_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(pd_cap_c);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c rv'c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q30524 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?G'30529 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c rv'c) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>cap_pd :== pde_Ptr rv'c;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(pd_cap_c);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q30524 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?G'30529 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (\<acute>cap_pd :== pde_Ptr pd_cap_c_ptr_maybe;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_fp_'proc(pd_cap_c);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cap_pd_' s +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>cap_pd 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (\<acute>cap_pd +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,\<acute>cap_pd,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = from_bool (isValidVTableRoot_C pd_cap_c)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q30524 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?G'32323 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_Ptr pd_cap_c_ptr_maybe +\<^sub>p 4080)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr pd_cap_c_ptr_maybe +\<^sub>p 4080))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = from_bool (isValidVTableRoot (cteCap pd_cap))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q30524 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?G'32323 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (from_bool (isValidVTableRoot (cteCap pd_cap)))) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF \<not> isValidVTableRoot (cteCap pd_cap) THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (19 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = from_bool (isValidVTableRoot (cteCap pd_cap)); \<not> isValidVTableRoot (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q32683 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?S32686 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (from_bool (isValidVTableRoot (cteCap pd_cap)))) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (19 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q32683 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?S32686 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)),pde_Ptr pd_cap_c_ptr_maybe);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))))))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q32683 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?P'32696 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q32683 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?C'32705 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (19 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot (cteCap pd_cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32695 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (SCAST(32 signed \<rightarrow> 32) false)) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = from_bool (isValidVTableRoot (cteCap pd_cap)); \<not> \<not> isValidVTableRoot (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R32682 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?T32684 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (from_bool (isValidVTableRoot (cteCap pd_cap)))) [SKIP] (if isValidVTableRoot (cteCap pd_cap) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R32682 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?T32684 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> capPDMappedASID (capCap (cteCap pd_cap)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R32682 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?T32684 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> capPDMappedASID (capCap (cteCap pd_cap)) \<noteq> None; pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R32682 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None pd_cap) (?G'32726 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c pd_cap_c_ptr_maybe (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)} (Guard MemorySafety \<lbrace>ptr_add_assertion (pde_Ptr pd_cap_c_ptr_maybe) 4080 True (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (pd_cap_c_ptr_maybe + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R32682 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None pd_cap) (?G'32726 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (global.capUntypedPtr (cteCap pd_cap))) 4080 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (global.capUntypedPtr (cteCap pd_cap) + 0x3FC0)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (global.capUntypedPtr (cteCap pd_cap))) 4081 (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (global.capUntypedPtr (cteCap pd_cap) + 0x3FC0)))));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A32750 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None pd_cap) (?C'32747 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (global.capUntypedPtr (cteCap pd_cap) + 0x3FC0)} (\<acute>stored_hw_asid___struct_pde_C :== h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (global.capUntypedPtr (cteCap pd_cap) + 0x3FC0)));;
(\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(\<acute>stored_hw_asid___struct_pde_C);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,\<acute>stored_hw_asid___struct_pde_C);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread))))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?Q32755 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None pd_cap a shw_asid) (?R32756 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid) [SKIP] (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>dom,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),ptr_val (ep_Ptr ret__unsignedc),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr ret__unsignedc);;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr ret__unsignedc,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned)\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 1,SCAST(32 signed \<rightarrow> 32) 1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>length___unsigned_long,\<acute>ksCurThread,tcb_Ptr ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_Ptr ret__unsigned,pde_Ptr pd_cap_c_ptr_maybe,shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>badge,\<acute>msgInfo,\<acute>ksCurThread)))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?Q32755 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None pd_cap a shw_asid) (?R32756 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid) [SKIP] (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C'']))));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))))))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid rvb dom. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; dom = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q33928 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid rvb) (?Q'33928 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid rvb dom) [SKIP] (do callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio rvb callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = rvb then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),dom));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo))))))))))))))))))))))))
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q33928 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom) (?Q'33928 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom') [SKIP] (do callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),curDom'));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo))))))))))))))))))))))))
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G35110 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom) (?Q'33928 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom') [SKIP] (do callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),curDom'));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo))))))))))))))))))))))))
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G35110 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom) (?Q'33928 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)) [SKIP] (do callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),UCAST(8 \<rightarrow> 32) curDom));;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))))
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A35121 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom) (?C'35118 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)) [SKIP] (do callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap caller_cap));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),UCAST(8 \<rightarrow> 32) curDom);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))))
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom' rvb. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P35134 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb) (?P'35133 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb) [SKIP] (do highest <- isHighestPrio curDom rvb;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),UCAST(8 \<rightarrow> 32) curDom);;
(IF \<acute>ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))))
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom s tcb. ?P35134 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) s \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?P35131 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?P'35133 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?P'35132 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_longa shw_asid curDom curDom' rvb rvc ret__unsigned_long. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain; rvc = to_bool ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q35140 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_longa shw_asid curDom curDom' rvb rvc) (?Q'35140 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_longa shw_asid curDom curDom' rvb rvc ret__unsigned_long) [SKIP] (if rvc then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__unsigned_long = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo)))))))))))))))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_longa shw_asid curDom curDom' rvb highest highest'. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain; highest = to_bool highest'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q35140 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_longa shw_asid curDom curDom' rvb highest) (?Q'35140 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_longa shw_asid curDom curDom' rvb highest highest') [SKIP] (if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF highest' = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo)))))))))))))))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q35140 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?Q'35140 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') [SKIP] (if highest' \<noteq> 0 then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF highest' = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q35140 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?Q'35140 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') [SKIP] (if highest' \<noteq> 0 then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF highest' = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))
ELSE
  SKIP;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))
FI)
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt36337 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?Rt36333 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt36337 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?P'36403 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt36337 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?C'36412 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'36402 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf36335 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?Rf36331 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') [SKIP] (do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (SKIP;;
(\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf36335 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?Rf36331 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest') [SKIP] (do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_asid_valid_'proc(shw_asid);;
(IF \<acute>ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf36335 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)) (?G'36441 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' ret__unsigned) [SKIP] (do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (IF ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned rva. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36784 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned rva) (?Q'36796 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' ret__unsigned rva) [SKIP] (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran rva} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36784 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap) (?Q'36796 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' ret__unsigned asidMap) [SKIP] (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); asid_map_pd_to_hwasids asidMap (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G36800 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap) (?Q'36796 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' ret__unsigned asidMap) [SKIP] (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF ret__unsigned = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); asid_map_pd_to_hwasids asidMap (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G36800 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) (?Q'36796 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) [SKIP] (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); asid_map_pd_to_hwasids asidMap (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid); stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36811 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) (?S36814 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) [SKIP] (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = 0; \<forall>x. (x, capPDBasePtr (capCap (cteCap pd_cap))) \<notin> ran asidMap; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36811 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y 0 asidMap) (?S36814 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' 0 asidMap) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (25 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = 0; \<forall>x. (x, capPDBasePtr (capCap (cteCap pd_cap))) \<notin> ran asidMap; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36811 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y 0 asidMap) (?P'36824 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' 0 asidMap) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 25 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (27 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = 0; \<forall>x. (x, capPDBasePtr (capCap (cteCap pd_cap))) \<notin> ran asidMap; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36811 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y 0 asidMap) (?C'36833 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' 0 asidMap) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 27 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = 0; \<forall>x. (x, capPDBasePtr (capCap (cteCap pd_cap))) \<notin> ran asidMap; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'36823 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' 0 asidMap) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); asid_map_pd_to_hwasids asidMap (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid); stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R36810 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) (?T36812 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) [SKIP] (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R36810 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) (?T36812 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) [SKIP] (do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A36855 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) (?C'36852 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap) [SKIP] (do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap caller_cap));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap rva. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36858 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap rva) (?Q'36869 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap rva) [SKIP] (if rva = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36858 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom) (?Q'36869 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (if destDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36858 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom) (?Q'36869 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (if destDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36858 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom) (?Q'36869 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (if destDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent syscall.SysReplyRecv)) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom THEN
  CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))
ELSE
  SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))
FI)
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> (obj_at' ((=) destDom \<circ> tcbDomain) (capTCBPtr (cteCap caller_cap)) and (\<lambda>s. ksCurDomain s = curDom \<and> curDom \<le> maxDomain \<and> destDom \<le> maxDomain)) s \<longrightarrow> (destDom \<noteq> curDom) = (s' \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> \<acute>ksCurDomain \<and> 0 <s maxDom\<rbrace>)
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid y asidMap destDom s s'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; ksCurDomain s \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; (s, s') \<in> rf_sr; obj_at' ((=) destDom \<circ> tcbDomain) (capTCBPtr (cteCap caller_cap)) s; destDom \<le> maxDomain\<rbrakk> \<Longrightarrow> (destDom \<noteq> ksCurDomain s) = (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> ksCurDomain_' (globals s') \<and> 0 <s maxDom)
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid y asidMap destDom s s'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; ksCurDomain s \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; (s, s') \<in> rf_sr; destDom \<le> maxDomain; \<exists>ko ko'. ko_at' ko (capTCBPtr (cteCap caller_cap)) s \<and> ((=) destDom \<circ> tcbDomain) ko \<and> cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (destDom \<noteq> ksCurDomain s) = (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> ksCurDomain_' (globals s') \<and> 0 <s maxDom)
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid y asidMap s s' ko ko'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; ksCurDomain s \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; (s, s') \<in> rf_sr; tcbDomain ko \<le> maxDomain; ko_at' ko (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ko'; ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (tcbDomain ko \<noteq> ksCurDomain s) = (tcbDomain_C ko' \<noteq> UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> 0 <s maxDom)
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid y asidMap s s' ko ko'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; ksCurDomain s \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; (s, s') \<in> rf_sr; tcbDomain ko \<le> maxDomain; ko_at' ko (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ko'; tcbDomain_C ko' = UCAST(8 \<rightarrow> 32) (tcbDomain ko)\<rbrakk> \<Longrightarrow> (tcbDomain ko \<noteq> ksCurDomain s) = (tcbDomain_C ko' \<noteq> UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> 0 <s maxDom)
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (25 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt36877 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom) (?Rt36886 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 25 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (25 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt36877 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?Rt36886 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 25 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt36877 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?P'36924 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv))
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt36877 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?C'36933 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (callKernel (SyscallEvent syscall.SysReplyRecv)) (Call slowpath_'proc)
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (25 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'36923 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) CALL slowpath_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) {},UNIV
A total of 25 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf36877 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom) (?Rf36884 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf36877 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?Rf36884 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf36877 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?Rf36884 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf36877 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?Rf36884 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread;
y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned));;
(\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))))
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P36974 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?P'36967 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned)))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; capAligned (theRight luRet)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G36979 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) (?P'36967 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) [SKIP] (threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned)))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom s tcb. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; capAligned (theRight luRet)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q36981 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom s tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned)) {s'. (s\<lparr>ksPSpace := (ksPSpace s)(curThread \<mapsto> injectKOS (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) tcb))\<rparr>, s') \<in> rf_sr}
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom s s' tcb tcb'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; capAligned (theRight luRet); (s, s') \<in> rf_sr; True; ko_at' tcb curThread s; cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some tcb'; ctcb_relation tcb tcb'; ksCurThread s = curThread; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {sa. sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<and> sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> is_aligned (capEPPtr (theRight luRet)) 4 \<and> SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<and> (\<forall>t. (\<exists>thread_state. tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<and> blockingObject_CL (thread_state_lift thread_state) = capEPPtr (theRight luRet) \<and> tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C'']) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift sa (cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) (t_hrs_' (globals sa))) \<longrightarrow> cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>ta. ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap) \<longrightarrow> t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<and> t \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && mask 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C'']) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (cparent (PTR(thread_state_C) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(curThread \<mapsto> injectKOS (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) tcb))\<rparr>, sa\<lparr>ret__unsigned_' := capCanGrant_CL (cap_endpoint_cap_lift ep_cap), globals := globals sa\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))}
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; capAligned (theRight luRet); (s, s') \<in> rf_sr; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> is_aligned (capEPPtr (theRight luRet)) 4 \<and> SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<and> (\<forall>t. (\<exists>thread_state. tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive \<and> blockingObject_CL (thread_state_lift thread_state) = capEPPtr (theRight luRet) \<and> tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')) \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift ep_cap)) \<longrightarrow> (\<exists>v. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some v) \<and> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) (t_hrs_' (globals t))) \<longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) tcb))\<rparr>, s'\<lparr>ret__unsigned_' := capCanGrant_CL (cap_endpoint_cap_lift ep_cap), globals := globals s'\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0 v0a v0c v1 v1a v2 v2a v3 v4 v5. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap v0 v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; (s, s') \<in> rf_sr; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap v0 v1 v2 True v4 v5; is_aligned v0 epSizeBits; epSizeBits < word_bits\<rbrakk> \<Longrightarrow> is_aligned v0 4 \<and> (\<forall>t. (\<exists>thread_state. tsType_CL (thread_state_lift thread_state) = 3 \<and> blockingObject_CL (thread_state_lift thread_state) = v0 \<and> tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')) \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift ep_cap)) \<longrightarrow> (\<exists>v. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some v) \<and> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) (t_hrs_' (globals t))) \<longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive v0 v4) tcb))\<rparr>, s'\<lparr>ret__unsigned_' := capCanGrant_CL (cap_endpoint_cap_lift ep_cap), globals := globals s'\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb))) (underlying_memory (ksMachineState s)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))) \<and> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> carch_state_relation (ksArchState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rparr>) \<and> cmachine_state_relation (ksMachineState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s')))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb))) (underlying_memory (ksMachineState s)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))))
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ctes ((ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb)))) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation ((map_to_tcbs (ksPSpace s))(ksCurThread s \<mapsto> tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb'))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb')))
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> \<forall>(getF, setF)\<in>ran tcb_cte_cases. getF (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb) = getF tcb
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation ((map_to_tcbs (ksPSpace s))(ksCurThread s \<mapsto> tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb'))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb')))
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(ksCurThread s \<mapsto> tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> ctcb_relation (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb) (tcbState_C_update (\<lambda>_. thread_statea) tcb')
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb' \<and> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (tcbFault_C tcb')) \<and> tcbIPCBuffer tcb = tcbIPCBuffer_C tcb' \<and> carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb') \<and> tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb' \<and> tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb') \<and> cfault_rel (tcbFault tcb) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')) \<and> option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> v4 = to_bool (capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1)
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> inj tcb_ptr_to_ctcb_ptr
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> carch_state_relation (ksArchState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rparr>) \<and> cmachine_state_relation (ksMachineState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s')))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> map_option tcbSchedNext_C \<circ> (cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb') = map_option tcbSchedNext_C \<circ> cslift s'
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> map_option tcbSchedPrev_C \<circ> (cslift s')(tcb_ptr_to_ctcb_ptr (ksCurThread s) \<mapsto> tcbState_C_update (\<lambda>_. thread_statea) tcb') = map_option tcbSchedPrev_C \<circ> cslift s'
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap s s' tcb tcb' v0a v0c v1 v1a v2 v2a v3 v4 v5 t thread_state ta tb thread_statea. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5) ep_cap; isRight luRet; cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; v3; \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (capability.ReplyCap v0a False v2a) caller_cap_c; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y))) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; \<not> v1a; {hwasid. (hwasid, v0c) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; ko_at' tcb (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; cteCap pd_cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); cteCap caller_cap = capability.ReplyCap v0a False v2a; theRight luRet = capability.EndpointCap (blockingObject_CL (thread_state_lift thread_state)) v1 v2 True v4 v5; is_aligned (blockingObject_CL (thread_state_lift thread_state)) 4; 4 < word_bits; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = 3; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap); thread_state_lift thread_statea = thread_state_lift thread_state\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rparr>) \<and> cmachine_state_relation (ksMachineState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_statea) tcb')) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread s)) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(ksCurThread s \<mapsto> KOTCB (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (blockingObject_CL (thread_state_lift thread_state)) v4) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s')))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (27 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' t t'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))))) (?d'36959 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv')
A total of 27 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36959 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva) (?Q'36959 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv') [SKIP] (do y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
(\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))))
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q36959 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva) (?Q'36959 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv') [SKIP] (do y <- setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))))
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P37205 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva) (?P'37193 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv') [SKIP] (setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread])) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI)
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'\<rbrakk> \<Longrightarrow> ep_Ptr (capEPPtr (theRight luRet)) = ep_Ptr (capEPPtr (theRight luRet))
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv' rv'a t t'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread))))))))))))) (?d'37193 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv' rv'a)
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv' rvc rv'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'; dc rvc rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37193 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv' rvc) (?Q'37193 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv' rvc rv'a) [SKIP] (do mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37193 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' ()) (?Q'37193 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' () rv'a) [SKIP] (do x <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
y <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A37250 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' ()) (?C'37247 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' () rv'a) [SKIP] (do x <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
y <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))))
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = mdbPrev (cteMDBNode rv)) ret__unsigned_' (?P37268 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' ()) (?P'37261 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' () rv'a) [SKIP] (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot)) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))))
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a \<sigma> cte cte'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (tcb_at' curThread and K (curThread = ksCurThread_y) and (\<lambda>s. ksCurThread s = ksCurThread_y)) \<sigma> \<and> s \<in> UNIV \<and> ctes_of \<sigma> (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<and> cslift s (cte_Ptr (curThread + 2 ^ cte_level_bits * tcbCallerSlot)) = Some cte' \<and> ccte_relation cte cte'} \<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))) {s. (\<sigma>, s) \<in> rf_sr \<and> ret__unsigned_' s = mdbPrev (cteMDBNode cte)}
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a \<sigma> cte cte'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> (tcb_at' curThread and K (curThread = ksCurThread_y) and (\<lambda>s. ksCurThread s = ksCurThread_y)) \<sigma> \<and> s \<in> UNIV \<and> ctes_of \<sigma> (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<and> cslift s (cte_Ptr (curThread + 2 ^ cte_level_bits * tcbCallerSlot)) = Some cte' \<and> ccte_relation cte cte'} \<subseteq> {s. \<forall>t. ret__unsigned_' t = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))))\<rparr>) \<in> rf_sr \<and> mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode cte)}
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap \<sigma> cte cte' x t. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; (\<sigma>, x) \<in> rf_sr; tcb_at' (ksCurThread \<sigma>) \<sigma>; ctes_of \<sigma> (ksCurThread \<sigma> + 0x30) = Some cte; cslift x (cte_Ptr (ksCurThread \<sigma> + 0x30)) = Some cte'; ccte_relation cte cte'; ret__unsigned_' t = mdbPrev_CL (mdb_node_lift (cteMDBNode_C cte'))\<rbrakk> \<Longrightarrow> mdbPrev_CL (mdb_node_lift (cteMDBNode_C cte')) = mdbPrev (cteMDBNode cte)
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (31 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rv'b t t'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread)))))))))))) (?d'37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rv'b)
A total of 31 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; rv'b = mdbPrev (cteMDBNode rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rva) (?Q'37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rva rv'b) [SKIP] (do y <- assert (mdbPrev (cteMDBNode rva) \<noteq> 0);
y <- updateMDB (mdbPrev (cteMDBNode rva)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv'b} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv'b\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo))))))))))))
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; rv'b = mdbPrev (cteMDBNode rva); mdbPrev (cteMDBNode rva) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rva) (?Q'37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a rva rv'b) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode rva)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr rv'b} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr rv'b\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo))))))))))))
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte) (?Q'37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode mdbPrev_cte)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr mdbPrev_cte_c} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr mdbPrev_cte_c\<rightarrow>[''cteMDBNode_C'']),0,1,1));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo))))))))))))
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P37746 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte) (?P'37736 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c) [SKIP] (updateMDB (mdbPrev (cteMDBNode mdbPrev_cte)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr mdbPrev_cte_c} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr mdbPrev_cte_c\<rightarrow>[''cteMDBNode_C'']),0,1,1)))
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P37746 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte) (?P'37736 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte))) [SKIP] (do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))\<rightarrow>[''cteMDBNode_C'']),0,1,1)))
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' ((=) mdbPrev_cte) (curThread + (tcbCallerSlot << cte_level_bits)) and valid_mdb') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))\<rightarrow>[''cteMDBNode_C'']),0,1,1)) {s. \<exists>(rv, \<sigma>')\<in>fst ((do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c \<sigma>. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' ((=) mdbPrev_cte) (curThread + (tcbCallerSlot << cte_level_bits)) and valid_mdb') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte)) \<and> s \<Turnstile>\<^sub>c cparent (mdb_Ptr &(cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C''] \<and> is_aligned 0 4 \<and> 1 && mask 1 = 1 \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift s (cparent (mdb_Ptr &(cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']))))\<lparr>mdbNext_CL := 0, mdbRevocable_CL := 1, mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (mdb_Ptr &(cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift s (cparent (mdb_Ptr &(cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))\<rightarrow>[''cteMDBNode_C''])) [''cteMDBNode_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>))))}
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ctes_of \<sigma> (curThread + (tcbCallerSlot << cte_level_bits)) = Some mdbPrev_cte; valid_mdb' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte)) \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))\<lparr>mdbNext_CL := 0, mdbRevocable_CL := 1, mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst ((do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; valid_mdb' \<sigma>; (\<sigma>, x) \<in> rf_sr; cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode mdbPrev_cte)) \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte)) \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))\<lparr>mdbNext_CL := 0, mdbRevocable_CL := 1, mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst ((do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x cte. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb' \<sigma>; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> (mdbPrev (cteMDBNode mdbPrev_cte)) = Some cte\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte)) \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))\<lparr>mdbNext_CL := 0, mdbRevocable_CL := 1, mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst ((do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x cte y'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb' \<sigma>; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> (mdbPrev (cteMDBNode mdbPrev_cte)) = Some cte; ctes_of \<sigma> (mdbPrev (cteMDBNode mdbPrev_cte)) = Some cte; ccte_relation cte y'; cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte)) \<and> (\<forall>t. (\<exists>mdb_node. mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))\<lparr>mdbNext_CL := 0, mdbRevocable_CL := 1, mdbFirstBadged_CL := 1\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) (cteMDBNode_C_update (\<lambda>_. mdb_node) (the (cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))))))) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst ((do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x cte y' t mdb_node. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb' \<sigma>; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> (mdbPrev (cteMDBNode mdbPrev_cte)) = Some cte; ccte_relation cte y'; cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) = Some y'; mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C y')\<lparr>mdbNext_CL := 0, mdbRevocable_CL := 1, mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) (cteMDBNode_C_update (\<lambda>_. mdb_node) y')) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst ((do cte <- getCTE (mdbPrev (cteMDBNode mdbPrev_cte));
setCTE (mdbPrev (cteMDBNode mdbPrev_cte)) (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte)
od) \<sigma>). (snd xa, x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) (cteMDBNode_C_update (\<lambda>_. mdb_node) y')) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x cte y' t mdb_node. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb' \<sigma>; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> (mdbPrev (cteMDBNode mdbPrev_cte)) = Some cte; ccte_relation cte y'; cslift x (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) = Some y'; mdb_node_lift mdb_node = mdb_node_lift (cteMDBNode_C y')\<lparr>mdbNext_CL := 0, mdbRevocable_CL := 1, mdbFirstBadged_CL := 1\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))) (cteMDBNode_C_update (\<lambda>_. mdb_node) y')) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> ccte_relation (cteMDBNode_update (\<lambda>_. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) (cteMDBNode cte)))) cte) (cteMDBNode_C_update (\<lambda>_. mdb_node) y')
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37736 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva) (?Q'37736 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b) [SKIP] (do y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo)))))))))))
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37736 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva) (?Q'37736 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b) [SKIP] (do y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
(\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo))))))))
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P37851 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva) (?P'37841 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b) [SKIP] (setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C))))
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' (\<lambda>_. True) (curThread + (tcbCallerSlot << cte_level_bits)) and tcb_at' curThread and K (curThread = ksCurThread_y)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C))) {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b \<sigma>. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' (\<lambda>_. True) (curThread + (tcbCallerSlot << cte_level_bits)) and tcb_at' curThread and K (curThread = ksCurThread_y)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<and> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = \<lparr>mdbNext_CL = 0 && ~~ mask 3, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, mdbPrev_CL = 0 && ~~ mask 3\<rparr> \<longrightarrow> hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<and> (\<exists>(rv, \<sigma>')\<in>fst (setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<sigma>). (\<sigma>', globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' ta)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) x))) (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' ta\<rparr>)) \<in> rf_sr \<and> dc rv (xfdc (globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' ta)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) x))) (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' ta\<rparr>)))))}
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x t cte. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ctes_of \<sigma> (ksCurThread_y + (tcbCallerSlot << cte_level_bits)) = Some cte; tcb_at' ksCurThread_y \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<and> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr> \<longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<and> (\<exists>xa\<in>fst (setCTE (ksCurThread_y + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' ta)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) x))) (x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' ta\<rparr>)) \<in> rf_sr))
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x t cte y'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ctes_of \<sigma> (ksCurThread_y + (tcbCallerSlot << cte_level_bits)) = Some cte; tcb_at' ksCurThread_y \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; ctes_of \<sigma> (ksCurThread_y + (tcbCallerSlot << cte_level_bits)) = Some cte; ccte_relation cte y'; cslift x (cte_Ptr (ksCurThread_y + (tcbCallerSlot << cte_level_bits))) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<and> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr> \<longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<and> (\<exists>xa\<in>fst (setCTE (ksCurThread_y + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) (ret__struct_mdb_node_C_' ta)) (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr (ksCurThread_y + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) x))) (x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' ta\<rparr>)) \<in> rf_sr))
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x t cte y' ta. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ctes_of \<sigma> (ksCurThread_y + 0x30) = Some cte; tcb_at' ksCurThread_y \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; ccte_relation cte y'; cslift x (cte_Ptr (ksCurThread_y + 0x30)) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' ta) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE (ksCurThread_y + 0x30) makeObject \<sigma>). (snd xa, globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr (ksCurThread_y + 0x30)) (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' ta) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr (ksCurThread_y + 0x30)) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) (h_val (hrs_mem x) (cte_Ptr (ksCurThread_y + 0x30))))) x)) (cte_Ptr (ksCurThread_y + 0x30))))) x)) (x\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, ret__struct_mdb_node_C_' := ret__struct_mdb_node_C_' ta\<rparr>)) \<in> rf_sr
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte \<sigma> x t cte y' ta. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ctes_of \<sigma> (ksCurThread_y + 0x30) = Some cte; tcb_at' ksCurThread_y \<sigma>; (\<sigma>, x) \<in> rf_sr; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap; ccte_relation cte y'; cslift x (cte_Ptr (ksCurThread_y + 0x30)) = Some y'; mdb_node_lift (ret__struct_mdb_node_C_' ta) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>\<rbrakk> \<Longrightarrow> ccte_relation makeObject (cteMDBNode_C_update (\<lambda>_. ret__struct_mdb_node_C_' ta) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) y'))
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (34 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37841 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc) (?Q'37841 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c) [SKIP] (do y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (\<acute>badge :== 0;;
(CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,\<acute>badge,\<acute>msgInfo)))))))
A total of 34 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (34 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q37841 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc) (?G'37938 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c) [SKIP] (do y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo))))))
A total of 34 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (36 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q38188 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd) (?Q'38188 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca) [SKIP] (do y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap));
y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running));;
(CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo)))))
A total of 36 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P38264 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd) (?P'38254 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca) [SKIP] (setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running)))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b rv'c xfdca. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P38264 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b () rv'c ()) (?P'38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b () rv'c () xfdca) [SKIP] (threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap caller_cap))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running)))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b rv'c xfdc s s' tcb tcb'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; (s, s') \<in> rf_sr; True; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {sa. sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<and> sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. (\<exists>thread_state. tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C''])) [''tcbState_C'']) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) (t_hrs_' (globals sa))) \<longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(capTCBPtr (cteCap caller_cap) \<mapsto> injectKOS (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb))\<rparr>, sa\<lparr>globals := globals sa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)}
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace s)(capTCBPtr (cteCap caller_cap) \<mapsto> KOTCB (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb))) (underlying_memory (ksMachineState s)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))) \<and> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> carch_state_relation (ksArchState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rparr>) \<and> cmachine_state_relation (ksMachineState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(capTCBPtr (cteCap caller_cap) \<mapsto> KOTCB (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s')))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace s)(capTCBPtr (cteCap caller_cap) \<mapsto> KOTCB (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb))) (underlying_memory (ksMachineState s)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')))
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ctes ((ksPSpace s)(capTCBPtr (cteCap caller_cap) \<mapsto> KOTCB (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb)))) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation ((map_to_tcbs (ksPSpace s))(capTCBPtr (cteCap caller_cap) \<mapsto> tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb'))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb')))
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (42 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> \<forall>(getF, setF)\<in>ran tcb_cte_cases. getF (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb) = getF tcb
A total of 42 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation ((map_to_tcbs (ksPSpace s))(capTCBPtr (cteCap caller_cap) \<mapsto> tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb'))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb')))
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(capTCBPtr (cteCap caller_cap) \<mapsto> tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (42 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> ctcb_relation (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb) (tcbState_C_update (\<lambda>_. thread_state) tcb')
A total of 42 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s')); cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> inj tcb_ptr_to_ctcb_ptr
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> carch_state_relation (ksArchState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rparr>) \<and> cmachine_state_relation (ksMachineState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(capTCBPtr (cteCap caller_cap) \<mapsto> KOTCB (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s')))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (42 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> map_option tcbSchedNext_C \<circ> (cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb') = map_option tcbSchedNext_C \<circ> cslift s'
A total of 42 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> map_option tcbSchedPrev_C \<circ> (cslift s')(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<mapsto> tcbState_C_update (\<lambda>_. thread_state) tcb') = map_option tcbSchedPrev_C \<circ> cslift s'
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y asidMap mdbPrev_cte s s' tcb tcb' t thread_state. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; ko_at' tcb (capTCBPtr (cteCap caller_cap)) s; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some tcb'; ctcb_relation tcb tcb'; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; tsType_CL (thread_state_lift thread_state) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tcbQueued_CL (thread_state_lift thread_state) = tcbQueued_CL (thread_state_lift (tcbState_C tcb')); t_hrs_' (globals t) = hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rparr>) \<and> cmachine_state_relation (ksMachineState s) (globals s'\<lparr>t_hrs_' := hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) (tcbState_C_update (\<lambda>_. thread_state) tcb')) (t_hrs_' (globals s'))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(capTCBPtr (cteCap caller_cap) \<mapsto> KOTCB (tcbState_update (\<lambda>x. Structures_H.thread_state.Running) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s')))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (39 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rv'd t t'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'd t t' (CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo)))) (?d'38254 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rv'd)
A total of 39 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (38 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q38254 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve) (?Q'38254 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd) [SKIP] (do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
y <- setCurThread (capTCBPtr (cteCap caller_cap));
y <- asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))]);
stateAssert kernelExitAssertions []
od) (CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo))))
A total of 38 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (38 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) rva rv'b rvc rv'c rvd xfdca rve) (?Q'38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) rva rv'b rvc rv'c rvd xfdca rve rv'd) [SKIP] (do y <- do y <- do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
setCurThread (capTCBPtr (cteCap caller_cap))
od;
asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])
od;
stateAssert kernelExitAssertions []
od) (CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo))))
A total of 38 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (38 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) rva rv'b rvc rv'c rvd xfdca rve and (\<lambda>s. \<forall>(rv, s')\<in>fst ((do y <- do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
setCurThread (capTCBPtr (cteCap caller_cap))
od;
asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])
od) s). kernelExitAssertions s')) (?Q'38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) rva rv'b rvc rv'c rvd xfdca rve rv'd) [SKIP] (do y <- do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
setCurThread (capTCBPtr (cteCap caller_cap))
od;
asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])
od) (CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid);;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo))))
A total of 38 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) rva rv'b rvc rv'c rvd xfdca rve) (?Q'38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) rva rv'b rvc rv'c rvd xfdca rve rv'd) [] (do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
setCurThread (capTCBPtr (cteCap caller_cap))
od) (CALL switchToThread_fp_'proc(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),pde_Ptr (global.capUntypedPtr (cteCap pd_cap)),shw_asid))
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd; dc rvf rv'e\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q38435 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf) (?Q'38435 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e) [SKIP] (asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])) (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo)))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd; dc rvf rv'e\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'38463 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf) (?Q38458 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e) [SKIP] (asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])) (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(seL4_MessageInfo_C (ARRAY i. msginfo),0);;
(\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo)))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd; dc rvf rv'e; seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))\<lparr>capsUnwrapped_CL := 0\<rparr>\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'38463 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf) (?G'38469 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C) [SKIP] (asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])) (\<acute>msgInfo :== CALL wordFromMessageInfo_'proc(ret__struct_seL4_MessageInfo_C);;
CALL fastpath_restore_'proc(\<acute>ksCurThread,0,\<acute>msgInfo))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C msgInfo. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd; dc rvf rv'e; seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))\<lparr>capsUnwrapped_CL := 0\<rparr>; \<forall>mi. seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = mi_from_H mi \<longrightarrow> msgInfo = wordFromMessageInfo mi\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'38463 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf) (?G'38585 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C msgInfo) [SKIP] (asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])) (CALL fastpath_restore_'proc(\<acute>ksCurThread,0,msgInfo))
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (42 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C msgInfo. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd; dc rvf rv'e; seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))\<lparr>capsUnwrapped_CL := 0\<rparr>; \<forall>mi. seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = mi_from_H mi \<longrightarrow> msgInfo = wordFromMessageInfo mi\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'38463 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf) (?C'38661 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C msgInfo) [SKIP] (asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])) (Call fastpath_restore_'proc)
A total of 42 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (41 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdc rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C msgInfo x ya s. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdc; dc rve rv'd; dc rvf rv'e; seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))\<lparr>capsUnwrapped_CL := 0\<rparr>; \<forall>mi. seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = mi_from_H mi \<longrightarrow> msgInfo = wordFromMessageInfo mi\<rbrakk> \<Longrightarrow> globals s = globals s
A total of 41 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdc rve rv'd rvf rv'e ret__struct_seL4_MessageInfo_C msgInfo s. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdc; dc rve rv'd; dc rvf rv'e; seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))\<lparr>capsUnwrapped_CL := 0\<rparr>; \<forall>mi. seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = mi_from_H mi \<longrightarrow> msgInfo = wordFromMessageInfo mi\<rbrakk> \<Longrightarrow> globals (msgInfo_'_update (\<lambda>x. msgInfo) (badge_'_update (\<lambda>x. 0) (cur_thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s))) = globals s
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (39 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdc rve rv'd. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdc; dc rve rv'd\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. \<forall>a\<in>fst ((do y <- do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
setCurThread (capTCBPtr (cteCap caller_cap))
od;
asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])
od) a). case a of (rv, s') \<Rightarrow> kernelExitAssertions s'\<rbrace> do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
setCurThread (capTCBPtr (cteCap caller_cap))
od \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = capTCBPtr (cteCap caller_cap)) and (\<lambda>a. capTCBPtr (cteCap caller_cap) = ksCurThread a)\<rbrace>
A total of 39 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (39 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y ret__unsigned asidMap mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. \<forall>(rv, y)\<in>fst ((do y <- do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
modify (ksCurThread_update (\<lambda>_. capTCBPtr (cteCap caller_cap)))
od;
asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])
od) a). kernelExitAssertions y\<rbrace> do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
modify (ksCurThread_update (\<lambda>_. capTCBPtr (cteCap caller_cap)))
od \<lbrace>\<lambda>a b. ksCurThread b = capTCBPtr (cteCap caller_cap) \<and> capTCBPtr (cteCap caller_cap) = ksCurThread b\<rbrace>
A total of 39 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (40 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y ret__unsigned asidMap mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q38668 luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y ret__unsigned asidMap mdbPrev_cte mdbPrev_cte_c\<rbrace> Arch.switchToThread (capTCBPtr (cteCap caller_cap)) \<lbrace>\<lambda>x s. ksCurThread (s\<lparr>ksCurThread := capTCBPtr (cteCap caller_cap)\<rparr>) = capTCBPtr (cteCap caller_cap) \<and> capTCBPtr (cteCap caller_cap) = ksCurThread (s\<lparr>ksCurThread := capTCBPtr (cteCap caller_cap)\<rparr>)\<rbrace>
A total of 40 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (39 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y ret__unsigned asidMap mdbPrev_cte mdbPrev_cte_c s. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; \<forall>(rv, y)\<in>fst ((do y <- do y <- Arch.switchToThread (capTCBPtr (cteCap caller_cap));
modify (ksCurThread_update (\<lambda>_. capTCBPtr (cteCap caller_cap)))
od;
asUser (capTCBPtr (cteCap caller_cap)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))])
od) s). kernelExitAssertions y\<rbrakk> \<Longrightarrow> True
A total of 39 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (38 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca rve rv'd. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca; dc rve rv'd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvf rv'e. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = capTCBPtr (cteCap caller_cap) \<longrightarrow> s' \<in> {s. \<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. 0) (seL4_MessageInfo_'_update (\<lambda>_. seL4_MessageInfo_C (ARRAY i. msginfo)) s)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. 0) (seL4_MessageInfo_'_update (\<lambda>_. seL4_MessageInfo_C (ARRAY i. msginfo)) s)) && mask 3\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> {s. \<forall>va. (\<forall>mi. seL4_MessageInfo_lift (mi_' (mi_'_update (\<lambda>_. v) s)) = mi_from_H mi \<longrightarrow> va = wordFromMessageInfo mi) \<longrightarrow> msgInfo_'_update (\<lambda>_. va) s \<in> {s. msgInfo_'_update (\<lambda>x. va) (badge_'_update (\<lambda>x. 0) (cur_thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s)) \<in> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))\<rbrace> \<inter> \<lbrace>\<acute>cur_thread = tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rbrace>}}}})
A total of 38 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (38 subgoals):
 1. \<And>luRet ep_cap rv send_ep send_ep_is_send caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom y ret__unsigned asidMap mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvf rv'e. {s'. \<forall>s. (s, s') \<in> rf_sr \<longrightarrow> ksCurThread s = capTCBPtr (cteCap caller_cap) \<longrightarrow> (\<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord msginfo)\<lparr>capsUnwrapped_CL := 0\<rparr> \<longrightarrow> (\<forall>v. (\<forall>mi. mi_from_H (messageInfoFromWord msginfo)\<lparr>capsUnwrapped_CL := 0\<rparr> = mi_from_H mi \<longrightarrow> v = wordFromMessageInfo mi) \<longrightarrow> v = wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msginfo))))})
A total of 38 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (37 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdc. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R38262 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd\<rbrace> setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' (capTCBPtr (cteCap caller_cap)) and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) and pd_has_hwasid (global.capUntypedPtr (cteCap pd_cap)) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 37 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (37 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b rv'c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R38262 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b () rv'c ()\<rbrace> setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap caller_cap)) \<lbrace>\<lambda>a b. pspace_aligned' b \<and> pspace_distinct' b \<and> valid_objs' b \<and> no_0_obj' b \<and> valid_pde_mappings' b \<and> valid_arch_state' b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 37 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (36 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c; dc rvd xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F38254 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca\<^esub> (?R'38254 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c rvd xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. s\<lparr>thread_' := tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)), cap_pd_' := pde_Ptr (global.capUntypedPtr (cteCap pd_cap)), stored_hw_asid___struct_pde_C_' := shw_asid\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rbrace> \<inter> \<lbrace>\<acute>cap_pd = pde_Ptr (global.capUntypedPtr (cteCap pd_cap))\<rbrace> \<inter> \<lbrace>\<acute>stored_hw_asid___struct_pde_C = shw_asid\<rbrace>}}
A total of 36 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (36 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b rv'c xfdc. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b () rv'c () xfdc\<^esub> (?R'38254 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b () rv'c () xfdc) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (CALL thread_state_ptr_set_tsType_np_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_Running)) \<lbrace>True\<rbrace>
A total of 36 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R38196 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc\<rbrace> mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters) \<lbrace>\<lambda>a. tcb_at' (capTCBPtr (cteCap caller_cap)) and (\<lambda>_. True) and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> (valid_objs' and valid_tcb_state' Structures_H.thread_state.Running) a \<and> no_0_obj' a \<and> valid_pde_mappings' a \<and> valid_arch_state' a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R38196 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b ()\<rbrace> mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap caller_cap)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters) \<lbrace>\<lambda>a b. tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_objs' b \<and> no_0_obj' b \<and> valid_pde_mappings' b \<and> valid_arch_state' b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (35 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b x s. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; x \<in> set (take (unat (msgLength (messageInfoFromWord msginfo))) TCB_H.msgRegisters); tcb_at' (capTCBPtr (cteCap caller_cap)) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_objs' s \<and> no_0_obj' s \<and> valid_pde_mappings' s \<and> valid_arch_state' s \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) s \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)\<rbrakk> \<Longrightarrow> tcb_at' (capTCBPtr (cteCap caller_cap)) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_objs' s \<and> no_0_obj' s \<and> valid_pde_mappings' s \<and> valid_arch_state' s \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) s \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)
A total of 35 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (34 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b; dc rvc rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'38188 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b rvc rv'c) CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)),\<acute>length___unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
A total of 34 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (34 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b rv'c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'38188 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b () rv'c) CALL fastpath_copy_mrs_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) UNIV
A total of 34 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R37849 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva\<rbrace> setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>_. unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters) and (\<lambda>a. tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_objs' a \<and> no_0_obj' a \<and> valid_pde_mappings' a \<and> valid_arch_state' a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R37849 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) ()\<rbrace> setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<lbrace>\<lambda>a b. unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_objs' b \<and> no_0_obj' b \<and> valid_pde_mappings' b \<and> valid_arch_state' b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (33 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?P'38912 curThread ctab ct luRet ep_cap cta bound_ntfn (ds_id False) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) ()\<rbrace> setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) s \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 33 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0; dc rva rv'b\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F37841 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b\<^esub> (?R'37841 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rva rv'b) \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. badge_'_update (\<lambda>_. 0) s \<in> {s. s\<lparr>src_' := ksCurThread_' (globals s), dest_' := tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)), length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = unat (msgLength (messageInfoFromWord msginfo))\<rbrace> \<inter> \<lbrace>\<acute>src = tcb_ptr_to_ctcb_ptr curThread\<rbrace> \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (32 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c rv'b. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F37841 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b\<^esub> (?R'37841 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte)) () rv'b) \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C))) \<lbrace>\<acute>length___unsigned_long = msgLength (messageInfoFromWord msginfo) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr curThread\<rbrace>
A total of 32 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (31 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R37744 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte\<rbrace> updateMDB (mdbPrev (cteMDBNode mdbPrev_cte)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a))) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) (curThread + (tcbCallerSlot << cte_level_bits)) and tcb_at' curThread and K (curThread = ksCurThread_y) and (\<lambda>a. unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> (valid_objs' and valid_cap' (cteCap makeObject)) a \<and> no_0_obj' a \<and> valid_pde_mappings' a \<and> valid_arch_state' a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> (cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) and (\<lambda>s. curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10)) a \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 31 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (31 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R37744 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte\<rbrace> updateMDB (mdbPrev (cteMDBNode mdbPrev_cte)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a))) \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (curThread + (tcbCallerSlot << cte_level_bits)) b \<and> tcb_at' curThread b \<and> curThread = ksCurThread_y \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_objs' b \<and> valid_cap' (cteCap makeObject) b \<and> no_0_obj' b \<and> valid_pde_mappings' b \<and> valid_arch_state' b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 31 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (30 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a mdbPrev_cte mdbPrev_cte_c. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; mdbPrev_cte_c = mdbPrev (cteMDBNode mdbPrev_cte); mdbPrev (cteMDBNode mdbPrev_cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F37736 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte))\<^esub> (?R'37736 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a mdbPrev_cte (mdbPrev (cteMDBNode mdbPrev_cte))) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))} (CALL mdb_node_ptr_mset_mdbNext_mdbRevocable_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbPrev (cteMDBNode mdbPrev_cte))\<rightarrow>[''cteMDBNode_C'']),0,1,1)) {s. (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread}
A total of 30 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R37266 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' ()\<rbrace> getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>a. cte_wp_at' ((=) a) (curThread + (tcbCallerSlot << cte_level_bits)) and valid_mdb' and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (curThread + (tcbCallerSlot << cte_level_bits)) a \<and> tcb_at' curThread a \<and> curThread = ksCurThread_y \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_objs' a \<and> valid_cap' (cteCap makeObject) a \<and> no_0_obj' a \<and> valid_pde_mappings' a \<and> valid_arch_state' a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> cte_wp_at' (\<lambda>c. isValidVTableRoot (cteCap c) \<and> capPDBasePtr (capCap (cteCap c)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (29 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R37266 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' ()\<rbrace> getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>a b. cte_wp_at' ((=) a) (curThread + (tcbCallerSlot << cte_level_bits)) b \<and> valid_mdb' b \<and> cte_wp_at' (\<lambda>_. True) (curThread + (tcbCallerSlot << cte_level_bits)) b \<and> tcb_at' curThread b \<and> curThread = ksCurThread_y \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_objs' b \<and> valid_cap' (cteCap makeObject) b \<and> no_0_obj' b \<and> valid_pde_mappings' b \<and> valid_arch_state' b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> cte_wp_at' (\<lambda>c. isValidVTableRoot (cteCap c) \<and> capPDBasePtr (capCap (cteCap c)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 29 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F37253 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a\<^esub> (?R'37260 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' () rv'a) \<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))) {s. \<forall>rv. ret__unsigned_' s = mdbPrev (cteMDBNode rv) \<longrightarrow> s \<in> UNIV \<inter> {sa. sa \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread)}}
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (28 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv' rv'a. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F37253 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom rv' rv'a\<^esub> (?R'37260 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv' () rv'a) \<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))) {s. \<forall>rv. ret__unsigned_' s = mdbPrev (cteMDBNode rv) \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread}
A total of 28 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (27 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R37203 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva\<rbrace> setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) \<lbrace>\<lambda>a. tcb_at' curThread and K (curThread = ksCurThread_y) and (\<lambda>s. ksCurThread s = ksCurThread_y) and (\<lambda>a. \<forall>cte. cte_wp_at' ((=) cte) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> cte_wp_at' ((=) cte) (curThread + (tcbCallerSlot << cte_level_bits)) a \<and> valid_mdb' a \<and> cte_wp_at' (\<lambda>_. True) (curThread + (tcbCallerSlot << cte_level_bits)) a \<and> tcb_at' curThread a \<and> curThread = ksCurThread_y \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_objs' a \<and> valid_cap' (cteCap makeObject) a \<and> no_0_obj' a \<and> valid_pde_mappings' a \<and> valid_arch_state' a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> cte_wp_at' (\<lambda>c. isValidVTableRoot (cteCap c) \<and> capPDBasePtr (capCap (cteCap c)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y))))\<rbrace>
A total of 27 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (27 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R37203 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom ()\<rbrace> setEndpoint (capEPPtr (theRight luRet)) (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) \<lbrace>\<lambda>a b. tcb_at' curThread b \<and> curThread = ksCurThread_y \<and> ksCurThread b = ksCurThread_y \<and> ((\<exists>cte. cte_wp_at' ((=) cte) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) b) \<longrightarrow> valid_mdb' b \<and> cte_wp_at' (\<lambda>_. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) b \<and> tcb_at' curThread b \<and> curThread = ksCurThread_y \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_objs' b \<and> valid_cap' (cteCap makeObject) b \<and> no_0_obj' b \<and> valid_pde_mappings' b \<and> valid_arch_state' b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> cte_wp_at' (\<lambda>c. isValidVTableRoot (cteCap c) \<and> capPDBasePtr (capCap (cteCap c)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' ksCurThread_y b\<rbrace>
A total of 27 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F37193 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv'\<^esub> (?R'37193 curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rva rv') \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> {s. \<forall>t. ret__unsigned_' t = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) \<longrightarrow> (\<forall>rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0, \<dots> = rva\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread)} \<inter> \<lbrace>tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace>}
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (26 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom rv'. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F37193 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv'\<^esub> (?R'37193 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom () rv') \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr (capEPPtr (theRight luRet)));;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr (capEPPtr (theRight luRet)),ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI {s. ((\<exists>t. ret__unsigned_' t = mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C'']))))) \<longrightarrow> (\<forall>rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread)) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries}
A total of 26 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (25 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R36972 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread \<lbrace>\<lambda>a. ko_at' send_ep (capEPPtr (theRight luRet)) and (\<lambda>s. curThread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(curThread := {r \<in> state_refs_of' s curThread. snd r = TCBBound}))) and (\<lambda>y. \<not> isSendEP send_ep) and valid_pspace' and cur_tcb' and (\<lambda>a. tcb_at' curThread a \<and> curThread = ksCurThread_y \<and> ksCurThread a = ksCurThread_y \<and> (valid_mdb' a \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> tcb_at' curThread a \<and> curThread = ksCurThread_y \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> (valid_objs' and valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread])) a \<and> valid_cap' (cteCap makeObject) a \<and> no_0_obj' a \<and> valid_pde_mappings' a \<and> valid_arch_state' a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' ksCurThread_y a)\<rbrace>
A total of 25 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (25 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R36972 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom\<rbrace> threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet)))) curThread \<lbrace>\<lambda>a b. cur_tcb' b \<and> no_0_obj' b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_arch_state' b \<and> valid_objs' b \<and> valid_pde_mappings' b \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread b \<and> ksCurThread b = ksCurThread_y \<and> valid_cap' (cteCap makeObject) b \<and> valid_mdb_ctes (ctes_of b) \<and> tcb_at' curThread b \<and> tcb_at' ksCurThread_y b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) b \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) b \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) b \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> r \<in> state_refs_of' b curThread} else state_refs_of' b a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b\<rbrace>
A total of 25 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (24 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap destDom. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F36959 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom\<^esub> (?R'36966 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0) highest' (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap destDom) Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_mset_blockingObject_tsType_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),capEPPtr (theRight luRet),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnReceive));;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(ep_cap);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']),\<acute>ret__unsigned)) {s. \<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)}
A total of 24 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?A36855 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap caller_cap)) \<lbrace>\<lambda>destDom. obj_at' ((=) destDom \<circ> tcbDomain) (capTCBPtr (cteCap caller_cap)) and (\<lambda>s. ksCurDomain s = curDom \<and> curDom \<le> maxDomain \<and> destDom \<le> maxDomain) and (\<lambda>s. destDom \<noteq> curDom \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) and (\<lambda>s. destDom = curDom \<longrightarrow> (tcb_at' curThread and (\<lambda>s. ksCurThread s = curThread) and (\<lambda>_. capAligned (theRight luRet)) and (\<lambda>a. cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> (valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) and valid_objs') a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> obj_at' (\<lambda>obj. if curThread = curThread then True else True) curThread a \<and> obj_at' (\<lambda>obj. if curThread = ksCurThread_y then True else True) ksCurThread_y a \<and> obj_at' (\<lambda>obj. if curThread = capTCBPtr (cteCap caller_cap) then True else True) (capTCBPtr (cteCap caller_cap)) a \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> r \<in> ((state_refs_of' a)(curThread := {(capEPPtr (theRight luRet), TCBBlockedRecv)} \<union> {r \<in> state_refs_of' a curThread. snd r = TCBBound})) curThread} else ((state_refs_of' a)(curThread := {(capEPPtr (theRight luRet), TCBBlockedRecv)} \<union> {r \<in> state_refs_of' a curThread. snd r = TCBBound})) aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)) s)\<rbrace>
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (23 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned asidMap. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap pd_cap))) \<in> ran asidMap} = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?A36855 curThread ctab ct luRet ep_cap cta bound_ntfn False send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)) asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap caller_cap)) \<lbrace>\<lambda>destDom a. obj_at' ((=) destDom \<circ> tcbDomain) (capTCBPtr (cteCap caller_cap)) a \<and> ksCurDomain a = curDom \<and> destDom \<le> maxDomain \<and> (destDom \<noteq> curDom \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (destDom = curDom \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' ksCurThread_y a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)\<rbrace>
A total of 23 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)\<rbrakk> \<Longrightarrow> \<lbrace>?Pf36335 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap. (\<lambda>a. (ret__unsigned = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (ret__unsigned \<noteq> 0 \<longrightarrow> ((\<lambda>a. \<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> obj_at' ((=) (tcbDomain tcb) \<circ> tcbDomain) (capTCBPtr (cteCap caller_cap)) a \<and> ksCurDomain a = curDom \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> curDom \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = curDom \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' ksCurThread_y a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))))) a)) and (\<lambda>_. asid_map_pd_to_hwasids asidMap (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb highest' y ret__unsigned. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y; ret__unsigned = stored_asid_valid_CL (pde_pde_invalid_lift shw_asid)\<rbrakk> \<Longrightarrow> \<lbrace>?Pf36335 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom) rvb (highest' \<noteq> 0)\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap a. (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) a \<and> ksCurDomain a = curDom \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> curDom \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = curDom \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' ksCurThread_y a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a) \<and> asid_map_pd_to_hwasids asidMap (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (21 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom' rvb. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain\<rbrakk> \<Longrightarrow> \<lbrace>?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb\<rbrace> isHighestPrio curDom rvb \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) and (\<lambda>s. a \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) s \<and> ksCurDomain s = curDom \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> curDom \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = curDom \<longrightarrow> tcb_at' curThread s \<and> ksCurThread s = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive ret__unsignedc (capEPCanGrant (theRight luRet))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread s \<and> ksCurThread s = ksCurThread_y \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' curThread s \<and> tcb_at' ksCurThread_y s \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s \<and> unat ret__unsigneda \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep ret__unsignedc s \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_cap_c_ptr_maybe = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_cap_c_ptr_maybe = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) s \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (ret__unsignedc, TCBBlockedRecv) \<or> r \<in> state_refs_of' s curThread \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = pd_cap_c_ptr_maybe) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (21 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> \<lbrace>?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb\<rbrace> isHighestPrio curDom rvb \<lbrace>\<lambda>a aa. (\<not> a \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (a \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) aa \<and> ksCurDomain aa = curDom \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> curDom \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = curDom \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread aa \<and> ksCurThread aa = ksCurThread_y \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' ksCurThread_y aa \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) aa \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid))\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?R35162 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R35159 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (22 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> \<lbrace>?P39654 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb\<rbrace> isHighestPrio curDom rvb \<lbrace>\<lambda>rv s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s\<rbrace>
A total of 22 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?P39654 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?P39652 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?P'39653 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?P'39651 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (21 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> \<lbrace>?P'39653 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb\<rbrace> isHighestPrio curDom rvb \<lbrace>\<lambda>rv s. rv \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) s \<and> ksCurDomain s = curDom \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> curDom \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = curDom \<longrightarrow> tcb_at' curThread s \<and> ksCurThread s = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread s \<and> ksCurThread s = ksCurThread_y \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' curThread s \<and> tcb_at' ksCurThread_y s \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) s \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) s \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' s curThread \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?P'39653 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?P'39651 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (21 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> \<lbrace>?P'39653 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb\<rbrace> isHighestPrio curDom rvb \<lbrace>\<lambda>rv s. (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) s \<and> ksCurDomain s = curDom \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> curDom \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = curDom \<longrightarrow> tcb_at' curThread s \<and> ksCurThread s = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread s \<and> ksCurThread s = ksCurThread_y \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' curThread s \<and> tcb_at' ksCurThread_y s \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) s \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) s \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' s curThread \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid)\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?P'39653 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c. ?P'39651 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom' rvb. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),UCAST(8 \<rightarrow> 32) curDom) {s. \<forall>rva. rva = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>ret__unsigned_long = 0\<rbrace> \<longrightarrow> sa \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>ret__unsigned_long = 0\<rbrace> \<longrightarrow> sa \<in> {s. \<forall>v v'. v = stored_asid_valid_CL (pde_pde_invalid_lift (pde_' (pde_'_update (\<lambda>_. shw_asid) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s'. \<forall>rva. s' \<in> {s. (v = 0 \<longrightarrow> s \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (v \<noteq> 0 \<longrightarrow> s \<in> {s'. \<forall>rva. s' \<in> {s. (s \<in> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) \<noteq> \<acute>ksCurDomain \<and> ret__inta <s maxDom\<rbrace> \<longrightarrow> s \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) \<noteq> \<acute>ksCurDomain \<and> ret__inta <s maxDom\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t ta. ret__unsigned_' ta = capCanGrant_CL (cap_endpoint_cap_lift ep_cap) \<longrightarrow> t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> t \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) [[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]] \<and> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (cparent (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) [[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]]))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && mask 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) [[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]]) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (cparent (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) [[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char True True rv rv True rv True rv, Char rv rv True rv True True True rv, Char True rv rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]]))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))})}} \<inter> \<lbrace>True\<rbrace>)}}}} \<inter> {s. pde_get_tag (pde_' (pde_'_update (\<lambda>_. shw_asid) s)) = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid})}}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid curDom curDom' rvb. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom' = UCAST(8 \<rightarrow> 32) curDom; curDom \<le> maxDomain\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),UCAST(8 \<rightarrow> 32) curDom) {s. (ret__unsigned_long_' s = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (ret__unsigned_long_' s \<noteq> 0 \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> ksCurDomain_' (globals s) \<and> 0 <s maxDom \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift ep_cap)) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift ep_cap)) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (20 subgoals):
 1. \<And>curThread ctab ct luRet ep_cap cta bound_ntfn rv send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb y. \<lbrakk>msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); \<not> rv; send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ccap_relation (cteCap pd_cap) pd_cap_c; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; curDom \<le> maxDomain; isReplyCap (cteCap caller_cap); \<not> capReplyMaster (cteCap caller_cap); isArchObjectCap (cteCap pd_cap); isPageDirectoryCap (capCap (cteCap pd_cap)); capPDMappedASID (capCap (cteCap pd_cap)) = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom rvb) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])),UCAST(8 \<rightarrow> 32) curDom) {s. (ret__unsigned_long_' s = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (ret__unsigned_long_' s \<noteq> 0 \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> ksCurDomain_' (globals s) \<and> 0 <s maxDom \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift ep_cap)) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift ep_cap)) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom tcb. ?R'35154 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom (tcbPriority tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c pd_cap pd_cap_c shw_asid curDom. ?R'35148 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid curDom (UCAST(8 \<rightarrow> 32) curDom)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (19 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<lbrace>?R33942 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None pd_cap shw_asid\<rbrace> curDomain \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) aa \<longrightarrow> ((\<lambda>aa. a \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa) and (\<lambda>aa. (invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) aa \<and> ksCurDomain aa = a \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> a \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = a \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive ret__unsignedc (capEPCanGrant (theRight luRet))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread aa \<and> ksCurThread aa = ksCurThread_y \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' ksCurThread_y aa \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa \<and> unat ret__unsigneda \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep ret__unsignedc aa \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) pd_cap_c_ptr_maybe = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) pd_cap_c_ptr_maybe = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (ret__unsignedc, TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = pd_cap_c_ptr_maybe) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid))) aa) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) and (\<lambda>_. a \<le> maxDomain)\<rbrace>
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (19 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid s. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; ?R33942 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) (ds_id 0) ctab ct luRet ep_cap cta (ds_id true) (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn (ds_id False) (ds_id false) (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c (ds_id true) (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) (ds_id None) pd_cap shw_asid s\<rbrakk> \<Longrightarrow> ((\<lambda>a. \<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> ((\<lambda>a. ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>a. (invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) a \<and> ksCurDomain a = ksCurDomain s \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain s \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = ksCurDomain s \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive ret__unsignedc (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' ksCurThread_y a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> unat ret__unsigneda \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep ret__unsignedc a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd_cap_c_ptr_maybe = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd_cap_c_ptr_maybe = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (ret__unsignedc, TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = pd_cap_c_ptr_maybe) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid))) a) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) and (\<lambda>_. ksCurDomain s \<le> maxDomain)) s
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'33936 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid) \<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {sa. dom_'_update (\<lambda>x. dom_' s) (prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv rv rv True rv True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char True True True True rv True True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char rv rv True rv True True True rv, Char True rv rv True True True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]]))) sa) \<in> UNIV \<inter> \<lbrace>\<acute>dom = \<^bsup>s\<^esup>dom\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)\<rbrace>} \<inter> {s. \<forall>t. (ret__unsigned_long_' t = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) \<noteq> ksCurDomain_' (globals s) \<and> ret__inta <s maxDom \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__inta <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))}} \<inter> \<lbrace>True\<rbrace>}
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (18 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c pd_cap_c_ptr_maybe ret__unsigned_long shw_asid. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isArchObjectCap (cteCap pd_cap) \<and> isPageDirectoryCap (capCap (cteCap pd_cap)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap pd_cap)) = Some y); pd_cap_c_ptr_maybe = global.capUntypedPtr (cteCap pd_cap); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'33936 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c (global.capUntypedPtr (cteCap pd_cap)) (SCAST(32 signed \<rightarrow> 32) true) shw_asid) \<acute>dom :== (if maxDom \<noteq> 0 then \<acute>ksCurDomain else 0) {s. (\<exists>rv. dom_' s = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> (\<forall>t. (ret__unsigned_long_' t = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) \<noteq> ksCurDomain_' (globals s) \<and> 0 <s maxDom \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))))}
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (17 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'29174 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(pd_cap_c) {s. s \<in> {sa. cap_pd_'_update (\<lambda>_. pde_Ptr (ret__unsigned_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (pd_cap_' (pd_cap_'_update (\<lambda>_. pd_cap_c) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot (cteCap pd_cap) \<longrightarrow> sa \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isValidVTableRoot (cteCap pd_cap) \<longrightarrow> sa \<in> {sa. \<forall>stored_hw_asid. True \<and> pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift sa \<circ>\<^sub>m pd_pointer_to_asid_slot) (ptr_val (pde_Ptr (ret__unsigned_' s))) = Some stored_hw_asid \<longrightarrow> sa\<lparr>stored_hw_asid___struct_pde_C_' := stored_hw_asid\<rparr> \<in> UNIV \<inter> {s. (\<exists>rv. (if maxDom \<noteq> ret__inta then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv rv rv True rv True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char True True True True rv True True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char rv rv True rv True True True rv, Char True rv rv True True True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> (\<forall>t. (ret__unsigned_long_' t = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) \<noteq> ksCurDomain_' (globals s) \<and> ret__inta <s maxDom \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__inta <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))))}} \<inter> \<lbrace>4081 \<le> 2 ^ (pdBits - 2) \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 4081 \<noteq> 0)\<rbrace> \<inter> \<lbrace>4080 \<le> 2 ^ (pdBits - 2) \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 4080 \<noteq> 0)\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = global.capUntypedPtr (cteCap pd_cap)\<rbrace>)}}}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (17 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'29174 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) pd_cap pd_cap_c) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(pd_cap_c) {s. isValidVTableRoot (cteCap pd_cap) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' s) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' s = global.capUntypedPtr (cteCap pd_cap)}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (16 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned rva rv'b pd_cap pd_cap_c s. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c); rv'b = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; rva = None; ccap_relation (cteCap pd_cap) pd_cap_c; True; (\<not> isValidVTableRoot (cteCap pd_cap) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> \<not> isValidVTableRoot (cteCap pd_cap) \<longrightarrow> ((\<lambda>a. page_directory_at' (ptr_val (pde_Ptr (global.capUntypedPtr (cteCap pd_cap)))) a \<and> valid_pde_mappings' a \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (ptr_val (pde_Ptr (global.capUntypedPtr (cteCap pd_cap)))) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> True \<and> ((\<lambda>a. ksCurDomain a \<le> maxDomain) and (\<lambda>a. ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a) \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> bitmapQ_no_L1_orphans a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) a \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain a \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = ksCurDomain a \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' ksCurThread_y a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap pd_cap)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap pd_cap)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (capPDBasePtr (capCap (cteCap pd_cap))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> ksCurDomain a \<le> maxDomain)) a)) and page_directory_at' (global.capUntypedPtr (cteCap pd_cap)) and page_directory_at' (global.capUntypedPtr (cteCap pd_cap))) s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. \<forall>t. (cap_get_tag pd_cap_c = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift pd_cap_c)) \<longrightarrow> isValidVTableRoot (cteCap pd_cap) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap pd_cap)} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(pd_cap_c) {s'. (s, s') \<in> rf_sr}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (15 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)\<rbrakk> \<Longrightarrow> \<lbrace>?R27063 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()\<rbrace> threadGet tcbFault (capTCBPtr (cteCap caller_cap)) \<lbrace>\<lambda>a aa. (a \<noteq> None \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> a \<noteq> None \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> True \<and> (\<not> isValidVTableRoot (cteCap cte) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (\<not> \<not> isValidVTableRoot (cteCap cte) \<longrightarrow> ((\<lambda>a. page_directory_at' (ptr_val (pde_Ptr (global.capUntypedPtr (cteCap cte)))) a \<and> valid_pde_mappings' a \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (ptr_val (pde_Ptr (global.capUntypedPtr (cteCap cte)))) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> True \<and> ((\<lambda>a. ksCurDomain a \<le> maxDomain) and (\<lambda>a. ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a) \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> bitmapQ_no_L1_orphans a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) a \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain a \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = ksCurDomain a \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive ret__unsignedc (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' ksCurThread_y a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> unat ret__unsigneda \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep ret__unsignedc a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> (\<exists>v. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap cte)) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (ret__unsignedc, TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cte)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> ksCurDomain a \<le> maxDomain)) a)) and page_directory_at' (global.capUntypedPtr (cteCap cte)) and page_directory_at' (global.capUntypedPtr (cteCap cte))) a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr ret__unsigned)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr ret__unsigned)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr ret__unsigned))) aa)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (15 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))\<rbrakk> \<Longrightarrow> \<lbrace>?R27063 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ()\<rbrace> threadGet tcbFault (capTCBPtr (cteCap caller_cap)) \<lbrace>\<lambda>a aa. ((\<exists>y. a = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (a = None \<longrightarrow> (\<forall>cte. ctes_of aa (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (\<not> isValidVTableRoot (cteCap cte) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread aa \<and> ksCurThread aa = ksCurThread_y \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' ksCurThread_y aa \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) aa \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cte)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) aa)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) aa)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F27049 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned\<^esub> (?R'27057 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () true ret__unsigned) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbFault_C''])))) {s. \<forall>rva. (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rva = None) \<longrightarrow> s \<in> {sa. fault_type_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {s. (rva \<noteq> None \<longrightarrow> s \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> rva \<noteq> None \<longrightarrow> s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> newVTable_'_update (\<lambda>_. cap) s \<in> {s. \<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> ret__inta then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv rv rv True rv True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char True True True True rv True True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char rv rv True rv True True True rv, Char True rv rv True True True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__inta <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap cte)}) \<and> cte_Ptr ((ret__unsigned && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot)} \<inter> \<lbrace>0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> (case rv of True \<Rightarrow> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) + 1 | False \<Rightarrow> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> (case rv of True \<Rightarrow> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) + 1 | False \<Rightarrow> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot)) \<le> uint tcbCNodeEntries\<rbrace>)}}}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (14 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__intb ret__unsignedb bound_ntfn rv rv'a ret__unsignedc send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c ret__int ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__intb = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsignedc = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; ret__int = true; isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap); ret__unsigned = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F27049 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))))\<^esub> (?R'27057 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c () true (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))))) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbFault_C''])))) {s. ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap cte))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; True\<rbrakk> \<Longrightarrow> \<lbrace>?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y caller_cap\<rbrace> return () \<lbrace>\<lambda>a b. ((isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> (isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cte. ctes_of a (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (\<not> isValidVTableRoot (cteCap cte) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) a \<and> valid_pde_mappings' a \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a) \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> bitmapQ_no_L1_orphans a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) a \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain a \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = ksCurDomain a \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive ret__unsigned (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread a \<and> ksCurThread a = ksCurThread_y \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' ksCurThread_y a \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> unat ret__unsigneda \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep ret__unsigned a \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (ret__unsigned, TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cte)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a \<and> ksCurDomain a \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) a)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) a))) b)\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (13 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c\<rbrakk> \<Longrightarrow> \<lbrace>?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep ksCurThread_y caller_cap\<rbrace> return () \<lbrace>\<lambda>a b. ((isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) b \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cte. ctes_of b (capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (\<not> isValidVTableRoot (cteCap cte) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) b \<and> valid_pde_mappings' b \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) b) \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap caller_cap)) b \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap caller_cap)) b \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain b \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbDomain tcb = ksCurDomain b \<longrightarrow> tcb_at' curThread b \<and> ksCurThread b = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' b \<and> no_0_obj' b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_arch_state' b \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) b \<and> valid_objs' b \<and> valid_pde_mappings' b \<and> curThread = ksCurThread_y \<and> curThread = ksCurThread b \<and> ksCurThread b = ksCurThread_y \<and> valid_cap' (cteCap makeObject) b \<and> valid_mdb_ctes (ctes_of b) \<and> tcb_at' curThread b \<and> tcb_at' ksCurThread_y b \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' send_ep (capEPPtr (theRight luRet)) b \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) b \<and> valid_ep' (case send_ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) b \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' b curThread \<and> snd r = TCBBound)} else state_refs_of' b a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cte)) (capTCBPtr (cteCap caller_cap) + tcbVTableSlot * 0x10) b)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b \<and> ksCurDomain b \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) b)) \<and> tcb_at' (capTCBPtr (cteCap caller_cap)) b)))\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R23498 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet)) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep s. ?R23495 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep (ksCurThread s)
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c) \<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(caller_cap_c) {s. \<forall>rva. (\<forall>cap. ccap_relation cap caller_cap_c \<longrightarrow> ret__int_' s = from_bool (isReplyCap cap \<and> \<not> capReplyMaster cap)) \<longrightarrow> s \<in> {s. ((isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)) \<longrightarrow> s \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. caller_cap_c) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. caller_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<longrightarrow> (\<forall>t. ret__unsigned_' t = rv' \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> ret__inta then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv rv rv True rv True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char True True True True rv True True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char rv rv True rv True True True rv, Char True rv rv True True True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0, \<dots> = rva\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0, \<dots> = rva\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__inta <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0, \<dots> = rva\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0, \<dots> = rva\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigneda \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap cte))) \<and> (v && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. caller_cap_c) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap})}}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (12 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet); send_ep_is_send \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP send_ep; ccap_relation (cteCap caller_cap) caller_cap_c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send ksCurThread_y caller_cap caller_cap_c) \<acute>ret__int :== CALL fastpath_reply_cap_check_'proc(caller_cap_c) {s. (\<forall>cap. ccap_relation cap caller_cap_c \<longrightarrow> ret__int_' s = from_bool (isReplyCap cap \<and> \<not> capReplyMaster cap)) \<longrightarrow> ((isReplyCap (cteCap caller_cap) \<longrightarrow> capReplyMaster (cteCap caller_cap)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (isReplyCap (cteCap caller_cap) \<and> \<not> capReplyMaster (cteCap caller_cap) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap caller_cap))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ksCurThread_y) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap cte))) \<and> (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift caller_cap_c) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap caller_cap) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag caller_cap_c = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send s. ?R'23490 curThread ctab ct luRet ep_cap cta bound_ntfn send_ep send_ep_is_send (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta bound_ntfn. ?R'23484 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (11 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> \<lbrace>?R19076 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False\<rbrace> getEndpoint (capEPPtr (theRight luRet)) \<lbrace>\<lambda>a. ko_at' a (capEPPtr (theRight luRet)) and valid_objs' and (\<lambda>aa. (isSendEP a \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP a \<longrightarrow> ((\<lambda>b. \<forall>cte. ctes_of b (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> True \<and> ((\<lambda>_. capAligned (cteCap cte)) and ((\<lambda>a. True) and (\<lambda>b. ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) b \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of b (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) b \<and> valid_pde_mappings' b \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) b) \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) b \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) b \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain b \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbDomain tcb = ksCurDomain b \<longrightarrow> tcb_at' curThread b \<and> ksCurThread b = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' b \<and> no_0_obj' b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_arch_state' b \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive ret__unsigned (capEPCanGrant (theRight luRet))) b \<and> valid_objs' b \<and> valid_pde_mappings' b \<and> curThread = ksCurThread aa \<and> curThread = ksCurThread b \<and> ksCurThread b = ksCurThread aa \<and> valid_cap' (cteCap makeObject) b \<and> valid_mdb_ctes (ctes_of b) \<and> tcb_at' curThread b \<and> tcb_at' (ksCurThread aa) b \<and> tcb_at' (capTCBPtr (cteCap cte)) b \<and> unat ret__unsigneda \<le> length TCB_H.msgRegisters \<and> ko_at' a ret__unsigned b \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) b \<and> valid_ep' (case a of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) b \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (ret__unsigned, TCBBlockedRecv) \<or> r \<in> state_refs_of' b curThread \<and> snd r = TCBBound)} else state_refs_of' b a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) b)) \<and> tcb_at' (capTCBPtr (cteCap cte)) b) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) b \<and> ksCurDomain b \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) b)) \<and> tcb_at' (capTCBPtr (cteCap cte)) b)))))) b) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))))) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)))))) aa))\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (11 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> \<lbrace>?R19076 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False\<rbrace> getEndpoint (capEPPtr (theRight luRet)) \<lbrace>\<lambda>a aa. ko_at' a (capEPPtr (theRight luRet)) aa \<and> valid_objs' aa \<and> (isSendEP a \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP a \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of aa (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread aa \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' (ksCurThread aa) aa \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> ko_at' a (capEPPtr (theRight luRet)) aa \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case a of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) aa \<and> tcb_at' (ksCurThread aa) aa)\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19062 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned\<^esub> (?R'19070 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))) \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr ret__unsigned) {s. \<forall>rva. (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rva \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' rva (capEPPtr (theRight luRet)) and valid_objs') s \<longrightarrow> s' \<in> {s. (isSendEP rva \<longrightarrow> s \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isSendEP rva \<longrightarrow> s \<in> {s. s \<in> {sa. callerSlot_'_update (\<lambda>_. cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) sa \<in> {sa. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> callerCap_'_update (\<lambda>_. cap) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> capAligned (cteCap cte) \<longrightarrow> s' \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> \<lbrace>\<acute>cap = cap\<rbrace>} \<inter> {sa. \<forall>t. (\<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift sa \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> ret__inta then ksCurDomain_' (globals sa) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift sa (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv rv rv True rv True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char True True True True rv True True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char rv rv True rv True True True rv, Char True rv rv True True True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = ksCurDomain_' (globals sa) \<longrightarrow> sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__inta <s maxDom \<longrightarrow> sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) rv'a, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)}}) \<and> cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (curThread + 2 ^ cte_level_bits * tcbCallerSlot)} \<inter> \<lbrace>True\<rbrace>} \<inter> {s. (ksCurThread_' \<circ> globals) s = tcb_ptr_to_ctcb_ptr curThread} \<inter> \<lbrace>0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> (case rv of True \<Rightarrow> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) + 1 | False \<Rightarrow> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot)) \<le> uint tcbCNodeEntries\<rbrace>})}}}
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (10 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsignedb bound_ntfn rv rv'a ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet); rv'a = false; \<not> rv; ret__unsigned = capEPPtr (theRight luRet)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19062 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))\<^esub> (?R'19070 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn False false (capEPPtr (theRight luRet))) \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(ep_Ptr (capEPPtr (theRight luRet))) {s. \<forall>rv. (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> ko_at' rv (capEPPtr (theRight luRet)) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries}
A total of 10 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> \<lbrace>?R16285 curThread ctab ct luRet cta bound_ntfn\<rbrace> case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr) \<lbrace>\<lambda>a aa. (\<not> \<not> a \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> \<not> \<not> a \<longrightarrow> (ep_at' (capEPPtr (theRight luRet)) and (\<lambda>s. \<forall>ep. ko_at' ep (capEPPtr (theRight luRet)) s \<longrightarrow> (ko_at' ep (capEPPtr (theRight luRet)) and valid_objs') s) and (\<lambda>a. \<forall>ep. ko_at' ep (capEPPtr (theRight luRet)) a \<longrightarrow> ko_at' ep (capEPPtr (theRight luRet)) a \<and> valid_objs' a \<and> (isSendEP ep \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of a (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) a \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of a (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) a \<and> valid_pde_mappings' a \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) a) \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> bitmapQ_no_L1_orphans a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) a \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain a \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = ksCurDomain a \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread a \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' (ksCurThread a) a \<and> tcb_at' (capTCBPtr (cteCap cte)) a \<and> unat ret__unsigneda \<le> length TCB_H.msgRegisters \<and> ko_at' ep (capEPPtr (theRight luRet)) a \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap cte)) a) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) a \<and> ksCurDomain a \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) a)) \<and> tcb_at' (capTCBPtr (cteCap cte)) a)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread a)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) a \<and> tcb_at' (ksCurThread a) a))) aa)\<rbrace>
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (9 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> \<lbrace>?R16285 curThread ctab ct luRet cta bound_ntfn\<rbrace> case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr) \<lbrace>\<lambda>a aa. (a \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> a \<longrightarrow> ep_at' (capEPPtr (theRight luRet)) aa \<and> ((\<exists>ep. ko_at' ep (capEPPtr (theRight luRet)) aa) \<longrightarrow> valid_objs' aa) \<and> (\<forall>ep. ko_at' ep (capEPPtr (theRight luRet)) aa \<longrightarrow> valid_objs' aa \<and> (isSendEP ep \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of aa (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (theRight luRet) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight luRet)) (capEPCanGrant (theRight luRet))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread aa \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' (ksCurThread aa) aa \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight luRet), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) aa \<and> tcb_at' (ksCurThread aa) aa)))\<rbrace>
A total of 9 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R16288 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet cta tcb. ?R16285 curThread ctab ct luRet cta (tcbBoundNotification tcb)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16266 msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn\<^esub> (?R'16282 curThread ctab ct luRet ep_cap cta bound_ntfn) Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool rv \<longrightarrow> s \<in> {sa. (\<not> \<not> rv \<longrightarrow> sa \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> \<not> \<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. ep_cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ep_ptr_'_update (\<lambda>_. ep_Ptr v) sa \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr v))) \<longrightarrow> s' \<in> UNIV} \<inter> {sa. \<forall>t rva. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rva \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__unsigned_' := ret__unsigned_' t\<rparr>) \<in> rf_sr \<and> ko_at' rva v s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rva \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__unsigned_' := ret__unsigned_' t\<rparr>) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift sa \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> ret__inta then ksCurDomain_' (globals sa) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift sa (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv rv rv True rv True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char True True True True rv True True rv, Char rv True rv rv True True True rv, Char True rv rv True rv True True rv, Char rv rv True rv True True True rv, Char True rv rv True True True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[[Char rv rv True rv True True True rv, Char True True rv rv rv True True rv, Char rv True rv rv rv True True rv, Char rv rv True rv rv rv True rv, Char True True True True rv True True rv, Char True rv True True rv True True rv, Char True rv rv rv rv True True rv, Char True rv rv True rv True True rv, Char rv True True True rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])) = ksCurDomain_' (globals sa) \<longrightarrow> sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__inta <s maxDom \<longrightarrow> sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rva. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[[Char True True rv rv rv True True rv, Char rv rv True rv True True True rv, Char True rv True rv rv True True rv, Char True rv True True rv rv True rv, Char rv rv True rv rv rv True rv, Char rv True rv rv rv rv True rv, Char rv True True True rv rv True rv, Char True True True True rv True True rv, Char rv rv True rv rv True True rv, Char True rv True rv rv True True rv, Char True True True True True rv True rv, Char True True rv rv rv rv True rv]])))) = mdbPrev (cteMDBNode rva) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rva)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) (ret__int_' s), mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigneda \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ep_cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})}}
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (8 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigneda rv' ret__inta ctab ct luRet ep_cap cta ret__int ret__unsigned bound_ntfn. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigneda = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__inta = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters; ccap_relation (theRight luRet) ep_cap; ret__int = true; ret__unsigned = SCAST(32 signed \<rightarrow> 32) true; isRight luRet; isEndpointCap (theRight luRet); cap_get_tag ep_cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capEPCanReceive (theRight luRet)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16266 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true) bound_ntfn\<^esub> (?R'16282 curThread ctab ct luRet ep_cap cta bound_ntfn) Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else 0));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>ksCurThread\<rightarrow>[''tcbBoundNotification_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool rv \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>t rv. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift ep_cap)) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift ep_cap) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))}
A total of 8 subgoals...
flex-flex pairs:
\<lambda>curThread ctab ct luRet ep_cap cta tcb. ?R'16282 curThread ctab ct luRet ep_cap cta (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>curThread ctab ct luRet ep_cap cta. ?R'16280 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 ctab ct luRet ep_cap cta true (SCAST(32 signed \<rightarrow> 32) true)
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R11857 curThread ctab ct\<rbrace> doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE \<lbrace>\<lambda>a. (\<lambda>aa. (isLeft a \<or> \<not> isEndpointCap (theRight a) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> (isLeft a \<or> \<not> isEndpointCap (theRight a)) \<longrightarrow> (\<not> capEPCanReceive (theRight a) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> \<not> capEPCanReceive (theRight a) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread aa \<longrightarrow> (bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread and valid_objs' and no_0_obj' and (\<lambda>s. curThread = ksCurThread s) and (\<lambda>aa. \<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> rv = False | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p aa) \<longrightarrow> (rv \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (theRight a)) aa \<and> ((\<exists>ep. ko_at' ep (capEPPtr (theRight a)) aa) \<longrightarrow> valid_objs' aa) \<and> (\<forall>ep. ko_at' ep (capEPPtr (theRight a)) aa \<longrightarrow> valid_objs' aa \<and> (isSendEP ep \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of aa (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (theRight a) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight a)) (capEPCanGrant (theRight a))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread aa \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' (ksCurThread aa) aa \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> unat ret__unsigned \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>b. if b = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight a), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa b) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) aa \<and> tcb_at' (ksCurThread aa) aa))))) aa)))) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct))))\<rbrace>
A total of 7 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R11857 curThread ctab ct\<rbrace> doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (do cte <- getCTE (fst t);
return (cteCap cte)
od)
odE \<lbrace>\<lambda>a aa. (isLeft a \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isEndpointCap (theRight a) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isRight a \<and> isEndpointCap (theRight a) \<longrightarrow> (\<not> capEPCanReceive (theRight a) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (capEPCanReceive (theRight a) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread aa \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread aa \<and> valid_objs' aa \<and> no_0_obj' aa \<and> curThread = ksCurThread aa \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p aa) \<longrightarrow> (rv \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (theRight a)) aa \<and> ((\<exists>ep. ko_at' ep (capEPPtr (theRight a)) aa) \<longrightarrow> valid_objs' aa) \<and> (\<forall>ep. ko_at' ep (capEPPtr (theRight a)) aa \<longrightarrow> valid_objs' aa \<and> (isSendEP ep \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of aa (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (theRight a) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight a)) (capEPCanGrant (theRight a))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread aa \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' (ksCurThread aa) aa \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>b. if b = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (theRight a), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa b) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) aa)) \<and> tcb_at' (capTCBPtr (cteCap cte)) aa)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) aa \<and> tcb_at' (ksCurThread aa) aa))))))) \<and> tcb_at' ct aa\<rbrace>
A total of 7 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R11857 curThread ctab ct\<rbrace> doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (do cte <- getCTE (fst t);
return (cteCap cte)
od)
odE \<lbrace>\<lambda>rv s. (False \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isEndpointCap rv \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> False \<and> isEndpointCap rv \<longrightarrow> (\<not> capEPCanReceive rv \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (capEPCanReceive rv \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread s \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread s \<and> valid_objs' s \<and> no_0_obj' s \<and> curThread = ksCurThread s \<and> (\<forall>rva. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rva | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rva) p s) \<longrightarrow> (rva \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> rva \<longrightarrow> ep_at' (capEPPtr rv) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr rv) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr rv) s \<longrightarrow> valid_objs' s \<and> (isSendEP ep \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of s (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) s \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of s (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) s) \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) s \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain s \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = ksCurDomain s \<longrightarrow> tcb_at' curThread s \<and> ksCurThread s = curThread \<and> capAligned rv \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr rv) (capEPCanGrant rv)) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> curThread = ksCurThread s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' curThread s \<and> tcb_at' (ksCurThread s) s \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) s \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr rv, TCBBlockedRecv) \<or> r \<in> state_refs_of' s curThread \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap cte)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ksCurDomain s \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) s)) \<and> tcb_at' (capTCBPtr (cteCap cte)) s)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s \<and> tcb_at' (ksCurThread s) s))))))) \<and> tcb_at' ct s\<rbrace>, \<lbrace>\<lambda>e s. \<forall>v. (True \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isEndpointCap v \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> True \<and> isEndpointCap v \<longrightarrow> (\<not> capEPCanReceive v \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (capEPCanReceive v \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread s \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread s \<and> valid_objs' s \<and> no_0_obj' s \<and> curThread = ksCurThread s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> (rv \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr v) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr v) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr v) s \<longrightarrow> valid_objs' s \<and> (isSendEP ep \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of s (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) s \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>ctea. ctes_of s (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) s) \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) s \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain s \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = ksCurDomain s \<longrightarrow> tcb_at' curThread s \<and> ksCurThread s = curThread \<and> capAligned v \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr v) (capEPCanGrant v)) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> curThread = ksCurThread s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' curThread s \<and> tcb_at' (ksCurThread s) s \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) s \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr v, TCBBlockedRecv) \<or> r \<in> state_refs_of' s curThread \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap cte)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ksCurDomain s \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) s)) \<and> tcb_at' (capTCBPtr (cteCap cte)) s)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s \<and> tcb_at' (ksCurThread s) s))))))) \<and> tcb_at' ct s\<rbrace>
A total of 7 subgoals...
flex-flex pairs:
\<lambda>curThread. ?R11860 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None \<equiv>\<^sup>? \<lambda>curThread ctab s. ?R11857 curThread ctab (ksCurThread s)
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P'39957 curThread ctab ct\<rbrace> CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr) \<lbrace>\<lambda>x s. \<forall>cte. cte_wp_at' ((=) cte) (fst x) s \<longrightarrow> (False \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> False \<and> isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread s \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread s \<and> valid_objs' s \<and> no_0_obj' s \<and> curThread = ksCurThread s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> (rv \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (isSendEP ep \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s) \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) s \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain s \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = ksCurDomain s \<longrightarrow> tcb_at' curThread s \<and> ksCurThread s = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> curThread = ksCurThread s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' curThread s \<and> tcb_at' (ksCurThread s) s \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) s \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s curThread \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> ksCurDomain s \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s \<and> tcb_at' (ksCurThread s) s))))))) \<and> tcb_at' ct s\<rbrace>, -
A total of 7 subgoals...
flex-flex pairs:
\<lambda>curThread ctab s. ?P'39957 curThread ctab (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread. ?P'39955 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (7 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P'39957 curThread ctab ct\<rbrace> CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr) \<lbrace>\<lambda>rv s. \<forall>rv' cte. cte_wp_at' ((=) cte) (fst rv') s \<longrightarrow> (False \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> False \<and> isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread s \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread s \<and> valid_objs' s \<and> no_0_obj' s \<and> curThread = ksCurThread s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> (rv \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (isSendEP ep \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s) \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) s \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain s \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = ksCurDomain s \<longrightarrow> tcb_at' curThread s \<and> ksCurThread s = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> curThread = ksCurThread s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' curThread s \<and> tcb_at' (ksCurThread s) s \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) s \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s curThread \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> ksCurDomain s \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s \<and> tcb_at' (ksCurThread s) s))))))) \<and> tcb_at' ct s\<rbrace>, -
A total of 7 subgoals...
flex-flex pairs:
\<lambda>curThread ctab s. ?P'39957 curThread ctab (ksCurThread s) \<equiv>\<^sup>? \<lambda>curThread. ?P'39955 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11852 curThread ctab ct) \<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr ct) && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C''])),cptr) {s. \<forall>rv. ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ep_cap_' s) \<longrightarrow> s \<in> {sa. sa \<in> {sa. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) (cap_'_update (\<lambda>_. ep_cap_' s) sa))) = cap_type_tag_' (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) (cap_'_update (\<lambda>_. ep_cap_' s) sa))] \<longrightarrow> sa\<lparr>ret__int_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = ret__int then 1 else ret__int\<rparr> \<in> {sa. (isLeft rv \<or> \<not> isEndpointCap (theRight rv) \<longrightarrow> sa \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> ret__int\<rbrace>) \<and> (\<not> (isLeft rv \<or> \<not> isEndpointCap (theRight rv)) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. ep_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else ret__int\<rparr> \<in> {sa. (\<not> capEPCanReceive (theRight rv) \<longrightarrow> sa \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capEPCanReceive (theRight rv) \<longrightarrow> sa \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> {sa. sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> ((if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(notification_C ptr) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else ret__int) \<noteq> ret__int \<longrightarrow> sa \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(notification_C ptr) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift sa (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(notification_C ptr) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbBoundNotification_C''])))))) \<longrightarrow> (\<forall>rv. (if notification_CL.state_CL (notification_lift (the (cslift sa (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(notification_C ptr) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else ret__int) = from_bool rv \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>t rv. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sb. (sb, sa\<lparr>ret__unsigned_' := notification_CL.state_CL (notification_lift (the (cslift sa (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(notification_C ptr) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbBoundNotification_C''])))))), ret__int_' := from_bool False\<rparr>) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ep_cap_' s))) sb \<and> valid_objs' sb) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__unsigned_' := notification_CL.state_CL (notification_lift (the (cslift sa (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(notification_C ptr) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbBoundNotification_C''])))))), ret__int_' := from_bool False\<rparr>) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift sa \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> ret__int then ksCurDomain_' (globals sa) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift sa (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals sa) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__int <s maxDom \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))) \<and> ((if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(notification_C ptr) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL then 1 else ret__int) = ret__int \<longrightarrow> (\<forall>rv. ret__int = from_bool rv \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>t rv. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sb. (sb, sa\<lparr>ret__int_' := ret__int\<rparr>) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ep_cap_' s))) sb \<and> valid_objs' sb) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__int_' := ret__int\<rparr>) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift sa \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> ret__int then ksCurDomain_' (globals sa) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift sa (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals sa) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> ret__int <s maxDom \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals sa)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals sa)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals sa)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' sa = ret__unsigned \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals sa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ep_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})}}} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbCTable \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbCTable + 1 | False \<Rightarrow> sint Kernel_C.tcbCTable) \<le> uint tcbCNodeEntries\<rbrace>}}
A total of 6 subgoals...
flex-flex pairs:
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (6 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned rv' ret__int ctab ct. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = msgLength (messageInfoFromWord msginfo); rv' = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ret__int = 0; msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo); msgExtraCaps (messageInfoFromWord msginfo) = 0; msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11852 curThread ctab ct) \<acute>ep_cap :== CALL lookup_fp_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr ct) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])),cptr) {s. \<forall>rv. ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ep_cap_' s) \<longrightarrow> (isLeft rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ep_cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (\<not> isEndpointCap (theRight rv) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ep_cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (isRight rv \<and> isEndpointCap (theRight rv) \<longrightarrow> (\<not> capEPCanReceive (theRight rv) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (capEPCanReceive (theRight rv) \<longrightarrow> (\<exists>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> ((\<exists>t. ret__unsigned_' t = notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C'']))))))) \<longrightarrow> (\<forall>rv. (if notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>t rv. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ep_cap_' s))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<forall>rv. from_bool rv = 0 \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>t rv. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ep_cap_' s))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> 0 <s maxDom \<longrightarrow> (\<forall>t. t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>ta. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift t (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ep_cap_' s)) && 1\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift t (ksCurThread_' (globals s)))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> ta \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))) \<and> cap_get_tag (ep_cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries}
A total of 6 subgoals...
flex-flex pairs:
\<lambda>curThread ctab s. ?R'11852 curThread ctab (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s))) \<equiv>\<^sup>? \<lambda>curThread. ?R'11846 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (msgLength (messageInfoFromWord msginfo)) None (SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) 0 proof (prove)
goal (5 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> \<lbrace>?R9074 msginfo cptr curThread msginfo cptr\<rbrace> threadGet tcbFault curThread \<lbrace>\<lambda>a aa. ((msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord msginfo') \<longrightarrow> a \<noteq> None) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> (msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord msginfo') \<longrightarrow> a \<noteq> None) \<longrightarrow> (a = None \<and> msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> (valid_cap' (cteCap cte) and valid_objs' and (\<lambda>b. (\<forall>v. (True \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> isEndpointCap v \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> True \<and> isEndpointCap v \<longrightarrow> (\<not> capEPCanReceive v \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (capEPCanReceive v \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread b \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread b \<and> valid_objs' b \<and> no_0_obj' b \<and> curThread = ksCurThread b \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p b) \<longrightarrow> (rv \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr v) b \<and> ((\<exists>ep. ko_at' ep (capEPPtr v) b) \<longrightarrow> valid_objs' b) \<and> (\<forall>ep. ko_at' ep (capEPPtr v) b \<longrightarrow> valid_objs' b \<and> (isSendEP ep \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of b (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> ((isReplyCap (cteCap cte) \<longrightarrow> capReplyMaster (cteCap cte)) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) b \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbFault tcb = a \<longrightarrow> (\<forall>ctea. ctes_of b (capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctea \<longrightarrow> (\<not> isValidVTableRoot (cteCap ctea) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isValidVTableRoot (cteCap ctea) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap ctea)) b \<and> valid_pde_mappings' b \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap ctea)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) b) \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cte)) b \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap cte)) b \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain b \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbDomain tcb = ksCurDomain b \<longrightarrow> tcb_at' curThread b \<and> ksCurThread b = curThread \<and> capAligned v \<and> cur_tcb' b \<and> no_0_obj' b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_arch_state' b \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr v) (capEPCanGrant v)) b \<and> valid_objs' b \<and> valid_pde_mappings' b \<and> curThread = ksCurThread b \<and> valid_cap' (cteCap makeObject) b \<and> valid_mdb_ctes (ctes_of b) \<and> tcb_at' curThread b \<and> tcb_at' (ksCurThread b) b \<and> tcb_at' (capTCBPtr (cteCap cte)) b \<and> unat ret__unsigned \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) b \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) b \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr v, TCBBlockedRecv) \<or> r \<in> state_refs_of' b curThread \<and> snd r = TCBBound)} else state_refs_of' b a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap ctea)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) b)) \<and> tcb_at' (capTCBPtr (cteCap cte)) b) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (capPDBasePtr (capCap (cteCap ctea))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap cte)) b \<and> ksCurDomain b \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap ctea)) b)) \<and> tcb_at' (capTCBPtr (cteCap cte)) b)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread b)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) b \<and> tcb_at' (ksCurThread b) b))))))) \<and> tcb_at' (ksCurThread aa) b) \<and> (\<forall>rv' cte. cte_wp_at' ((=) cte) (fst rv') b \<longrightarrow> (False \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> False \<and> isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread b \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread b \<and> valid_objs' b \<and> no_0_obj' b \<and> curThread = ksCurThread b \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p b) \<longrightarrow> (rv \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) b \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) b) \<longrightarrow> valid_objs' b) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) b \<longrightarrow> valid_objs' b \<and> (isSendEP ep \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of b (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) b \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbFault tcb = a \<longrightarrow> (\<forall>cteb. ctes_of b (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) b \<and> valid_pde_mappings' b \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) b) \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) b \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) b \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain b \<longrightarrow> invs' b \<and> ct_in_state' ((=) Structures_H.thread_state.Running) b) \<and> (tcbDomain tcb = ksCurDomain b \<longrightarrow> tcb_at' curThread b \<and> ksCurThread b = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' b \<and> no_0_obj' b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> valid_arch_state' b \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) b \<and> valid_objs' b \<and> valid_pde_mappings' b \<and> curThread = ksCurThread b \<and> valid_cap' (cteCap makeObject) b \<and> valid_mdb_ctes (ctes_of b) \<and> tcb_at' curThread b \<and> tcb_at' (ksCurThread b) b \<and> tcb_at' (capTCBPtr (cteCap ctea)) b \<and> unat ret__unsigned \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) b \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) b \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' b curThread \<and> snd r = TCBBound)} else state_refs_of' b a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) b)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) b) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState b)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) b \<and> ksCurDomain b \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) b)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) b)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread b)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) b \<and> tcb_at' (ksCurThread b) b))))))) \<and> tcb_at' (ksCurThread aa) b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa))))) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa))))) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)))))) aa)) \<and> (\<not> (a = None \<and> msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> word_of_nat size_msgRegisters) \<longrightarrow> True))\<rbrace>
A total of 5 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))\<rbrakk> \<Longrightarrow> \<lbrace>?R9074 msginfo cptr curThread msginfo cptr\<rbrace> threadGet tcbFault curThread \<lbrace>\<lambda>a aa. ((msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> (\<exists>y. a = Some y)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<and> a = None \<longrightarrow> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) aa \<and> valid_objs' aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> ((\<exists>v. \<not> isEndpointCap v) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> tcb_at' (ksCurThread aa) aa \<and> (\<forall>aaa cte. cte_wp_at' ((=) cte) aaa aa \<longrightarrow> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread aa \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread aa \<and> valid_objs' aa \<and> no_0_obj' aa \<and> curThread = ksCurThread aa \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p aa) \<longrightarrow> (rv \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) aa \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) aa) \<longrightarrow> valid_objs' aa) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) aa \<longrightarrow> valid_objs' aa \<and> (isSendEP ep \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of aa (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread aa \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' (ksCurThread aa) aa \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa \<and> unat (msgLength (messageInfoFromWord msginfo)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) aa)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) aa \<and> tcb_at' (ksCurThread aa) aa))))))) \<and> tcb_at' (ksCurThread aa) aa) \<and> tcb_at' (ksCurThread aa) aa))\<rbrace>
A total of 5 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F9060 msgInfo cptra curThread msginfo' info ret__unsigned\<^esub> (?R'9068 msginfo cptr curThread msginfo cptr info ret__unsigned) \<acute>length___unsigned_long :== ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C''])))) {s. \<forall>rv. (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None) \<longrightarrow> s \<in> {sa. fault_type_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {s. \<forall>v v'. (v = 0) = (msgExtraCaps (messageInfoFromWord (msgInfo_' (msgInfo_'_update (\<lambda>_. msginfo) s))) = 0 \<and> msgLength (messageInfoFromWord (msgInfo_' (msgInfo_'_update (\<lambda>_. msginfo) s))) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY a. K (msgInfo_' (msgInfo_'_update (\<lambda>_. msginfo) s)) a)) = mi_from_H (messageInfoFromWord (msgInfo_' (msgInfo_'_update (\<lambda>_. msginfo) s)))) \<longrightarrow> s\<lparr>ret__int_' := v\<rparr> \<in> {s. s \<in> {s. ((msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord msginfo') \<longrightarrow> rv \<noteq> None) \<longrightarrow> s \<in> {s. syscall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv) s \<in> \<lbrace>\<acute>syscall = syscall_from_H syscall.SysReplyRecv\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord msginfo') \<longrightarrow> rv \<noteq> None) \<longrightarrow> s \<in> {s. (rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> word_of_nat size_msgRegisters \<longrightarrow> s \<in> {s. \<forall>cte cte'. cslift s (cte_Ptr (curThread + 2 ^ cte_level_bits * tcbCTableSlot)) = Some cte' \<and> ccte_relation cte cte' \<longrightarrow> s \<in> {s. s \<in> {sa. cptr_'_update (\<lambda>_. cptra) (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (ksCurThread_' (globals s)))) && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable\<rightarrow>[''cap_C'']))) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (cteCap cte) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>cptr = cptra\<rbrace>} \<inter> {s. \<forall>t rv. ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t) \<longrightarrow> (isLeft rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = v) \<and> (\<not> isEndpointCap (theRight rv) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = v) \<and> (isRight rv \<and> isEndpointCap (theRight rv) \<longrightarrow> (\<not> capEPCanReceive (theRight rv) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (capEPCanReceive (theRight rv) \<longrightarrow> (\<exists>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>rv. (if notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else v) = from_bool rv \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, ep_cap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, ep_cap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> v then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> v <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries)))) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<forall>rv. from_bool rv = v \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, ep_cap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, ep_cap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> v then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> v <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = ret__unsigned \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))) \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries} \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbCTable \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbCTable + 1 | False \<Rightarrow> sint Kernel_C.tcbCTable) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint Kernel_C.tcbCTable \<and> (case False of True \<Rightarrow> sint Kernel_C.tcbCTable + 1 | False \<Rightarrow> sint Kernel_C.tcbCTable) \<le> uint tcbCNodeEntries\<rbrace>}}) \<and> (\<not> (rv = None \<and> msgExtraCaps (messageInfoFromWord msginfo') = 0 \<and> msgLength (messageInfoFromWord msginfo') \<le> word_of_nat size_msgRegisters) \<longrightarrow> s \<in> UNIV)})}}} \<inter> \<lbrace>True\<rbrace>}}
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>msgInfo cptra curThread msginfo' info ret__unsigned. \<lbrakk>msgInfo = msginfo; cptra = cptr; msginfo' = msginfo; info = seL4_MessageInfo_C (ARRAY i. msginfo); ret__unsigned = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F9060 msginfo cptr curThread msginfo (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))))\<^esub> (?R'9068 msginfo cptr curThread msginfo cptr (seL4_MessageInfo_C (ARRAY i. msginfo)) (length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo))))) \<acute>length___unsigned_long :== length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(\<acute>ksCurThread\<rightarrow>[''tcbFault_C''])))) {s. \<forall>rv. (ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rv = None) \<longrightarrow> (\<forall>v. (v = 0) = (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo)) \<longrightarrow> ((msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<longrightarrow> (\<exists>y. rv = Some y)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (msgExtraCaps (messageInfoFromWord msginfo) = 0 \<and> msgLength (messageInfoFromWord msginfo) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. msginfo)) = mi_from_H (messageInfoFromWord msginfo) \<and> rv = None \<longrightarrow> msgLength (messageInfoFromWord msginfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. (\<exists>cte'. cslift s (cte_Ptr (curThread + 2 ^ cte_level_bits * tcbCTableSlot)) = Some cte' \<and> ccte_relation cte cte') \<longrightarrow> ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rv. ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t) \<longrightarrow> (isLeft rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = v) \<and> (\<not> isEndpointCap (theRight rv) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = v) \<and> (isRight rv \<and> isEndpointCap (theRight rv) \<longrightarrow> (\<not> capEPCanReceive (theRight rv) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (capEPCanReceive (theRight rv) \<longrightarrow> (\<exists>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>rv. (if notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else v) = from_bool rv \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> v then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> v <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries)))) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<forall>rv. from_bool rv = v \<longrightarrow> (rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> v then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> v <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rv. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rv) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rv)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> length___unsigned_long_' s = msgLength (messageInfoFromWord msginfo) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = curThread + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr curThread \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))) \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries)))}
A total of 4 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>msgInfo cptra curThread rv. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q6627 msgInfo cptra curThread rv\<rbrace> asUser curThread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr'. cur_tcb' and (\<lambda>s. curThread = ksCurThread s) and (\<lambda>a. \<forall>tcb. ko_at' tcb curThread a \<longrightarrow> ((msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = mi_from_H (messageInfoFromWord rv) \<longrightarrow> (\<exists>y. tcbFault tcb = Some y)) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = mi_from_H (messageInfoFromWord rv) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of a (curThread + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) a \<and> valid_objs' a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> ((\<exists>v. \<not> isEndpointCap v) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> tcb_at' (ksCurThread a) a \<and> (\<forall>aa cte. cte_wp_at' ((=) cte) aa a \<longrightarrow> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread a \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread a \<and> valid_objs' a \<and> no_0_obj' a \<and> curThread = ksCurThread a \<and> (\<forall>rva. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rva | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rva) p a) \<longrightarrow> (rva \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (\<not> rva \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) a \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) a) \<longrightarrow> valid_objs' a) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) a \<longrightarrow> valid_objs' a \<and> (isSendEP ep \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of a (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) a \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of a (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) a \<and> valid_pde_mappings' a \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) a) \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> bitmapQ_no_L1_orphans a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) a \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain a \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = ksCurDomain a \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread a \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' (ksCurThread a) a \<and> tcb_at' (capTCBPtr (cteCap ctea)) a \<and> unat (msgLength (messageInfoFromWord rv)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) a) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) a \<and> ksCurDomain a \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) a)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) a)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread a)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) a \<and> tcb_at' (ksCurThread a) a))))))) \<and> tcb_at' (ksCurThread a) a) \<and> tcb_at' (ksCurThread a) a))) and (\<lambda>_. rv = msginfo \<and> cptr' = cptr)\<rbrace>
A total of 3 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>msgInfo cptra curThread rv. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q6627 msginfo cptr curThread rv\<rbrace> asUser curThread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr' a. cur_tcb' a \<and> curThread = ksCurThread a \<and> (\<forall>tcb. ko_at' tcb curThread a \<longrightarrow> ((msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = mi_from_H (messageInfoFromWord rv) \<longrightarrow> (\<exists>y. tcbFault tcb = Some y)) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = mi_from_H (messageInfoFromWord rv) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of a (curThread + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) a \<and> valid_objs' a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> ((\<exists>v. \<not> isEndpointCap v) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> tcb_at' (ksCurThread a) a \<and> (\<forall>aa cte. cte_wp_at' ((=) cte) aa a \<longrightarrow> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread a \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread a \<and> valid_objs' a \<and> no_0_obj' a \<and> curThread = ksCurThread a \<and> (\<forall>rva. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rva | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rva) p a) \<longrightarrow> (rva \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (\<not> rva \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) a \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) a) \<longrightarrow> valid_objs' a) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) a \<longrightarrow> valid_objs' a \<and> (isSendEP ep \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of a (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) a \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of a (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) a \<and> valid_pde_mappings' a \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) a) \<longrightarrow> ksCurDomain a \<le> maxDomain \<and> bitmapQ_no_L1_orphans a \<and> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) a \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) a \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain a \<longrightarrow> invs' a \<and> ct_in_state' ((=) Structures_H.thread_state.Running) a) \<and> (tcbDomain tcb = ksCurDomain a \<longrightarrow> tcb_at' curThread a \<and> ksCurThread a = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' a \<and> no_0_obj' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) a \<and> valid_objs' a \<and> valid_pde_mappings' a \<and> curThread = ksCurThread a \<and> valid_cap' (cteCap makeObject) a \<and> valid_mdb_ctes (ctes_of a) \<and> tcb_at' curThread a \<and> tcb_at' (ksCurThread a) a \<and> tcb_at' (capTCBPtr (cteCap ctea)) a \<and> unat (msgLength (messageInfoFromWord rv)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) a \<and> sym_refs (\<lambda>aa. if aa = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' a curThread \<and> snd r = TCBBound)} else state_refs_of' a aa) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) a)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) a) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) a \<and> ksCurDomain a \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) a)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) a)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread a)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) a \<and> tcb_at' (ksCurThread a) a))))))) \<and> tcb_at' (ksCurThread a) a) \<and> tcb_at' (ksCurThread a) a))) \<and> rv = msginfo \<and> cptr' = cptr\<rbrace>
A total of 3 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>msgInfo cptra curThread. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?P6640 msginfo cptr curThread\<rbrace> asUser curThread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>a aa. tcb_at' curThread aa \<and> (\<forall>rv. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = rv) curThread aa \<longrightarrow> cur_tcb' aa \<and> curThread = ksCurThread aa \<and> (\<forall>tcb. ko_at' tcb curThread aa \<longrightarrow> ((msgExtraCaps (messageInfoFromWord a) = 0 \<and> msgLength (messageInfoFromWord a) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. a)) = mi_from_H (messageInfoFromWord a) \<longrightarrow> (\<exists>y. tcbFault tcb = Some y)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (msgExtraCaps (messageInfoFromWord a) = 0 \<and> msgLength (messageInfoFromWord a) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. a)) = mi_from_H (messageInfoFromWord a) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord a) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) aa \<and> valid_objs' aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> ((\<exists>v. \<not> isEndpointCap v) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> tcb_at' (ksCurThread aa) aa \<and> (\<forall>aaa cte. cte_wp_at' ((=) cte) aaa aa \<longrightarrow> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread aa \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread aa \<and> valid_objs' aa \<and> no_0_obj' aa \<and> curThread = ksCurThread aa \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p aa) \<longrightarrow> (rv \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) aa \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) aa) \<longrightarrow> valid_objs' aa) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) aa \<longrightarrow> valid_objs' aa \<and> (isSendEP ep \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of aa (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread aa \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' (ksCurThread aa) aa \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa \<and> unat (msgLength (messageInfoFromWord a)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) aa)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) aa \<and> tcb_at' (ksCurThread aa) aa))))))) \<and> tcb_at' (ksCurThread aa) aa) \<and> tcb_at' (ksCurThread aa) aa))) \<and> a = msgInfo \<and> rv = cptra)\<rbrace>
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>msgInfo cptra curThread. \<lbrakk>msgInfo = msginfo; cptra = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?P6640 msginfo cptr curThread\<rbrace> asUser curThread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>a aa. tcb_at' curThread aa \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rv) curThread aa \<longrightarrow> cur_tcb' aa \<and> curThread = ksCurThread aa \<and> (\<forall>tcb. ko_at' tcb curThread aa \<longrightarrow> ((msgExtraCaps (messageInfoFromWord a) = 0 \<and> msgLength (messageInfoFromWord a) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. a)) = mi_from_H (messageInfoFromWord a) \<longrightarrow> (\<exists>y. tcbFault tcb = Some y)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (msgExtraCaps (messageInfoFromWord a) = 0 \<and> msgLength (messageInfoFromWord a) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. a)) = mi_from_H (messageInfoFromWord a) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord a) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) aa \<and> valid_objs' aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> ((\<exists>v. \<not> isEndpointCap v) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> tcb_at' (ksCurThread aa) aa \<and> (\<forall>aaa cte. cte_wp_at' ((=) cte) aaa aa \<longrightarrow> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb curThread aa \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) curThread aa \<and> valid_objs' aa \<and> no_0_obj' aa \<and> curThread = ksCurThread aa \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p aa) \<longrightarrow> (rv \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) aa \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) aa) \<longrightarrow> valid_objs' aa) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) aa \<longrightarrow> valid_objs' aa \<and> (isSendEP ep \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of aa (curThread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of aa (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) aa \<and> valid_pde_mappings' aa \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa) \<longrightarrow> ksCurDomain aa \<le> maxDomain \<and> bitmapQ_no_L1_orphans aa \<and> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) aa \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) aa \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain aa \<longrightarrow> invs' aa \<and> ct_in_state' ((=) Structures_H.thread_state.Running) aa) \<and> (tcbDomain tcb = ksCurDomain aa \<longrightarrow> tcb_at' curThread aa \<and> ksCurThread aa = curThread \<and> capAligned (cteCap cte) \<and> cur_tcb' aa \<and> no_0_obj' aa \<and> pspace_aligned' aa \<and> pspace_distinct' aa \<and> valid_arch_state' aa \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) aa \<and> valid_objs' aa \<and> valid_pde_mappings' aa \<and> curThread = ksCurThread aa \<and> valid_cap' (cteCap makeObject) aa \<and> valid_mdb_ctes (ctes_of aa) \<and> tcb_at' curThread aa \<and> tcb_at' (ksCurThread aa) aa \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa \<and> unat (msgLength (messageInfoFromWord a)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (curThread + 2 ^ cte_level_bits * tcbCallerSlot) aa \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]) aa \<and> sym_refs (\<lambda>a. if a = curThread then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' aa curThread \<and> snd r = TCBBound)} else state_refs_of' aa a) \<and> curThread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) aa)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState aa)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa \<and> ksCurDomain aa \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) aa)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) aa)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread aa)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) aa \<and> tcb_at' (ksCurThread aa) aa))))))) \<and> tcb_at' (ksCurThread aa) aa) \<and> tcb_at' (ksCurThread aa) aa))) \<and> a = msginfo \<and> rv = cptr)\<rbrace>
A total of 2 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>msgInfo cptra s s'. \<lbrakk>msgInfo = msginfo; cptra = cptr; (s, s') \<in> rf_sr; invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> tcb_at' rv s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = rva) rv s \<longrightarrow> tcb_at' rv s \<and> (\<forall>rvb. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rvb) rv s \<longrightarrow> cur_tcb' s \<and> rv = ksCurThread s \<and> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> ((msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rva)) = mi_from_H (messageInfoFromWord rva) \<longrightarrow> (\<exists>y. tcbFault tcb = Some y)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rva)) = mi_from_H (messageInfoFromWord rva) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord rva) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (rv + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> ((\<exists>v. \<not> isEndpointCap v) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) rv s \<and> valid_objs' s \<and> no_0_obj' s \<and> rv = ksCurThread s \<and> (\<forall>rvb. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rvb | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rvb) p s) \<longrightarrow> (rvb \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> rvb \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (isSendEP ep \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (rv + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s) \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) s \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain s \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = ksCurDomain s \<longrightarrow> tcb_at' rv s \<and> ksCurThread s = rv \<and> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> rv = ksCurThread s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' rv s \<and> tcb_at' (ksCurThread s) s \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> unat (msgLength (messageInfoFromWord rva)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (rv + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [rv]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [rv]) s \<and> sym_refs (\<lambda>a. if a = rv then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s rv \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> rv + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> ksCurDomain s \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s \<and> tcb_at' (ksCurThread s) s))))))) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s))) \<and> rva = msgInfo \<and> rvb = cptra))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s'. \<forall>rva. s' \<in> {s'. \<forall>rvb. s' \<in> {s. \<forall>v. v = seL4_MessageInfo_C (ARRAY a. K (w_' (w_'_update (\<lambda>_. rva) s)) a) \<longrightarrow> info_'_update (\<lambda>_. v) s \<in> {s. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. v) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> (\<forall>rvb. (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rvb = None) \<longrightarrow> (\<forall>vb. (vb = 0) = (msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord rva)) \<longrightarrow> ((msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord rva) \<longrightarrow> (\<exists>y. rvb = Some y)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord rva) \<and> rvb = None \<longrightarrow> msgLength (messageInfoFromWord rva) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. (\<exists>cte'. cslift s (cte_Ptr (rv + 2 ^ cte_level_bits * tcbCTableSlot)) = Some cte' \<and> ccte_relation cte cte') \<longrightarrow> ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rvb. ccap_relation (case rvb of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t) \<longrightarrow> (isLeft rvb \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = vb) \<and> (\<not> isEndpointCap (theRight rvb) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = vb) \<and> (isRight rvb \<and> isEndpointCap (theRight rvb) \<longrightarrow> (\<not> capEPCanReceive (theRight rvb) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (capEPCanReceive (theRight rvb) \<longrightarrow> (\<exists>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>rvb. (if notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else vb) = from_bool rvb \<longrightarrow> (rvb \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rvb \<longrightarrow> (\<forall>ta rvb. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rvb \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr \<and> ko_at' rvb (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rvb \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> vb then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> vb <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = rv + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries)))) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<forall>rvb. from_bool rvb = vb \<longrightarrow> (rvb \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rvb \<longrightarrow> (\<forall>ta rvb. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rvb \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr \<and> ko_at' rvb (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rvb \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> vb then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> vb <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = rv + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))) \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries)))))}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>msgInfo cptra s s'. \<lbrakk>msgInfo = msginfo; cptra = cptr; (s, s') \<in> rf_sr; invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread s = rv \<longrightarrow> tcb_at' rv s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = rva) rv s \<longrightarrow> tcb_at' rv s \<and> (\<forall>rvb. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rvb) rv s \<longrightarrow> cur_tcb' s \<and> rv = ksCurThread s \<and> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> ((msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rva)) = mi_from_H (messageInfoFromWord rva) \<longrightarrow> (\<exists>y. tcbFault tcb = Some y)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rva)) = mi_from_H (messageInfoFromWord rva) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord rva) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (rv + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> ((\<exists>v. \<not> isEndpointCap v) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> (\<not> isEndpointCap (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isEndpointCap (cteCap cte) \<longrightarrow> (\<not> capEPCanReceive (cteCap cte) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (capEPCanReceive (cteCap cte) \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) rv s \<and> valid_objs' s \<and> no_0_obj' s \<and> rv = ksCurThread s \<and> (\<forall>rvb. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rvb | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rvb) p s) \<longrightarrow> (rvb \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> rvb \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (isSendEP ep \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (rv + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> ((isReplyCap (cteCap ctea) \<longrightarrow> capReplyMaster (cteCap ctea)) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> ((\<exists>y. tcbFault tcb = Some y) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbFault tcb = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> (\<not> isValidVTableRoot (cteCap cteb) \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> ((\<exists>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s) \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) = 0 \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> obj_at' (\<lambda>a. tcbDomain tcb = tcbDomain a) (capTCBPtr (cteCap ctea)) s \<and> tcbDomain tcb \<le> maxDomain \<and> (tcbDomain tcb \<noteq> ksCurDomain s \<longrightarrow> invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s) \<and> (tcbDomain tcb = ksCurDomain s \<longrightarrow> tcb_at' rv s \<and> ksCurThread s = rv \<and> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> rv = ksCurThread s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> tcb_at' rv s \<and> tcb_at' (ksCurThread s) s \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> unat (msgLength (messageInfoFromWord rva)) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (rv + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [rv]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [rv]) s \<and> sym_refs (\<lambda>a. if a = rv then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s rv \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> rv + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s \<and> ksCurDomain s \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s)))) \<and> cte_wp_at' (\<lambda>_. True) ((ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s \<and> tcb_at' (ksCurThread s) s))))))) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s))) \<and> rva = msgInfo \<and> rvb = cptra))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister\<rbrakk> \<Longrightarrow> cur_tcb' s \<and> (msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0 \<and> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid) \<and> ksCurDomain s \<le> maxDomain) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s))))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister\<rbrakk> \<Longrightarrow> cur_tcb' s \<and> (msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0 \<and> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> bitmapQ_no_L1_orphans s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s))))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister\<rbrakk> \<Longrightarrow> msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0 \<and> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> bitmapQ_no_L1_orphans s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s)))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; Invariants_H.valid_queues s\<rbrakk> \<Longrightarrow> msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0 \<and> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> bitmapQ_no_L1_orphans s \<and> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s)))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; valid_queues_no_bitmap s \<and> valid_bitmapQ s \<and> bitmapQ_no_L2_orphans s \<and> bitmapQ_no_L1_orphans s\<rbrakk> \<Longrightarrow> msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0 \<and> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s)))))
A total of 2 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; valid_queues_no_bitmap s \<and> valid_bitmapQ s \<and> bitmapQ_no_L2_orphans s \<and> bitmapQ_no_L1_orphans s\<rbrakk> \<Longrightarrow> pspace_aligned' s
A total of 3 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; valid_queues_no_bitmap s \<and> valid_bitmapQ s \<and> bitmapQ_no_L2_orphans s \<and> bitmapQ_no_L1_orphans s; is_aligned (ksCurThread s) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0 \<and> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s)))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; valid_queues_no_bitmap s \<and> valid_bitmapQ s \<and> bitmapQ_no_L2_orphans s \<and> bitmapQ_no_L1_orphans s; is_aligned (ksCurThread s) tcbBlockSizeBits; cte_wp_at' (\<lambda>_. True) (ksCurThread s + 0x10 * tcbCallerSlot) s\<rbrakk> \<Longrightarrow> msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0 \<and> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<and> tcbFault tcb = None \<longrightarrow> msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte \<longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C))) s)))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * 0x10) s; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 2 ^ cte_level_bits) = Some cte\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + tcbVTableSlot * 2 ^ cte_level_bits) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s))))))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * 0x10) s; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 2 ^ cte_level_bits) = Some cte; \<exists>ts ntfnptr. Structures_H.thread_state.Running = ts \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) (ksCurThread s) s \<and> state_refs_of' s (ksCurThread s) = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cte) s \<and> valid_objs' s \<and> (\<forall>a cte. cte_wp_at' ((=) cte) a s \<longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPCanReceive (cteCap cte) \<longrightarrow> bound_tcb_at' ((=) (tcbBoundNotification tcb)) (ksCurThread s) s \<and> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>rv. (case tcbBoundNotification tcb of None \<Rightarrow> \<not> rv | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. EndpointDecls_H.isActive ntfn = rv) p s) \<longrightarrow> \<not> rv \<longrightarrow> ep_at' (capEPPtr (cteCap cte)) s \<and> ((\<exists>ep. ko_at' ep (capEPPtr (cteCap cte)) s) \<longrightarrow> valid_objs' s) \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap cte)) s \<longrightarrow> valid_objs' s \<and> (\<not> isSendEP ep \<longrightarrow> (\<forall>ctea. ctes_of s (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) = Some ctea \<longrightarrow> capAligned (cteCap ctea) \<and> (isReplyCap (cteCap ctea) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap ctea)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap ctea) + tcbVTableSlot * 2 ^ cte_level_bits) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap cte) \<and> cur_tcb' s \<and> no_0_obj' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte))) s \<and> valid_objs' s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs (\<lambda>a. if a = ksCurThread s then {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap cte), TCBBlockedRecv) \<or> r \<in> state_refs_of' s (ksCurThread s) \<and> snd r = TCBBound)} else state_refs_of' s a) \<and> ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits \<noteq> capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap ctea) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s))))))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * 0x10) s; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 2 ^ cte_level_bits) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; cte_wp_at' ((=) ctea) a s; isEndpointCap (cteCap ctea); capEPCanReceive (cteCap ctea); case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv\<rbrakk> \<Longrightarrow> ep_at' (capEPPtr (cteCap ctea)) s \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap cte)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap cte) + tcbVTableSlot * 2 ^ cte_level_bits) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap ctea) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ctea)) (capEPCanGrant (cteCap ctea))) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap ctea), TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; cte_wp_at' (\<lambda>_. True) (ksCurThread s + tcbCallerSlot * 0x10) s; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 2 ^ cte_level_bits) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; cte_wp_at' ((=) ctea) a s; isEndpointCap (cteCap ctea); capEPCanReceive (cteCap ctea); case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; \<exists>cte. True \<and> valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> ep_at' (capEPPtr (cteCap ctea)) s \<and> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cte. ctes_of s (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) = Some cte \<longrightarrow> capAligned (cteCap cte) \<and> (isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap cte)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cteb. ctes_of s (capTCBPtr (cteCap cte) + tcbVTableSlot * 2 ^ cte_level_bits) = Some cteb \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cteb)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (cteCap ctea) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ctea)) (capEPCanGrant (cteCap ctea))) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> cte_wp_at' (\<lambda>a. True) (ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits) s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (capEPPtr (cteCap ctea), TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 2 ^ cte_level_bits \<noteq> capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10 \<and> cte_wp_at' (\<lambda>a. isValidVTableRoot (cteCap a) \<and> capPDBasePtr (capCap (cteCap a)) = global.capUntypedPtr (cteCap cteb)) (capTCBPtr (cteCap cte) + tcbVTableSlot * 0x10) s)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cteb))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cteb)) s)))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5\<rbrakk> \<Longrightarrow> ep_at' v0 s \<and> (\<forall>ep. ko_at' ep v0 s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> capAligned (cteCap cteb) \<and> ((\<exists>v0 v1 v2. cteCap cteb = capability.ReplyCap v0 v1 v2) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap cteb)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cte. ctes_of s (capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10) = Some cte \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (capability.EndpointCap v0 v1 v2 True v4 v5) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cte)) = global.capUntypedPtr (cteCap cte))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) s))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; valid_cap' (cteCap ctea) s\<rbrakk> \<Longrightarrow> ep_at' v0 s \<and> (\<forall>ep. ko_at' ep v0 s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> capAligned (cteCap cteb) \<and> ((\<exists>v0 v1 v2. cteCap cteb = capability.ReplyCap v0 v1 v2) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap cteb)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cte. ctes_of s (capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10) = Some cte \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> capAligned (capability.EndpointCap v0 v1 v2 True v4 v5) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cte)) = global.capUntypedPtr (cteCap cte))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) s))))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5) \<and> ep_at' v0 s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep v0 s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> capAligned (cteCap cteb) \<and> ((\<exists>v0 v1 v2. cteCap cteb = capability.ReplyCap v0 v1 v2) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap cteb)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cte. ctes_of s (capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10) = Some cte \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cte)) = global.capUntypedPtr (cteCap cte))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) s)))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> capAligned (cteCap cteb) \<and> ((\<exists>v0 v1 v2. cteCap cteb = capability.ReplyCap v0 v1 v2) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap cteb)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cte. ctes_of s (capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10) = Some cte \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cte)) = global.capUntypedPtr (cteCap cte))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) s)))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; valid_cap' (cteCap cteb) s\<rbrakk> \<Longrightarrow> capAligned (cteCap cteb) \<and> ((\<exists>v0 v1 v2. cteCap cteb = capability.ReplyCap v0 v1 v2) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> (\<forall>tcba. tcbs_of s (capTCBPtr (cteCap cteb)) = Some tcba \<longrightarrow> tcbFault tcba = None \<longrightarrow> (\<forall>cte. ctes_of s (capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10) = Some cte \<longrightarrow> isValidVTableRoot (cteCap cte) \<longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cte)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cte)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> capTCBPtr (cteCap cteb) + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cte)) = global.capUntypedPtr (cteCap cte))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cte)) s)))
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; valid_cap' (capability.ReplyCap v0a False v2a) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; isValidVTableRoot (cteCap cted)\<rbrakk> \<Longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cted)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cted)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cted)) = global.capUntypedPtr (cteCap cted))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cted))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cted)) s
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; valid_cap' (capability.ReplyCap v0a False v2a) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; isValidVTableRoot (cteCap cted); cte_wp_at' (\<lambda>_. True) (v0a + 0x10 * tcbVTableSlot) s\<rbrakk> \<Longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cted)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cted)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cted)) = global.capUntypedPtr (cteCap cted))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cted))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cted)) s
A total of 2 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; valid_cap' (capability.ReplyCap v0a False v2a) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; isValidVTableRoot (cteCap cted); cte_wp_at' (\<lambda>_. True) (v0a + 0x10 * tcbVTableSlot) s\<rbrakk> \<Longrightarrow> pspace_aligned' s
A total of 3 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; valid_cap' (capability.ReplyCap v0a False v2a) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; isValidVTableRoot (cteCap cted); cte_wp_at' (\<lambda>_. True) (v0a + 0x10 * tcbVTableSlot) s; is_aligned v0a tcbBlockSizeBits\<rbrakk> \<Longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cted)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cted)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cted)) = global.capUntypedPtr (cteCap cted))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cted))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cted)) s
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; valid_cap' (capability.ReplyCap v0a False v2a) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; isValidVTableRoot (cteCap cted); ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a\<rbrakk> \<Longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cted)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cted)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cted)) = global.capUntypedPtr (cteCap cted))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cted))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cted)) s
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; capAligned (capability.ReplyCap v0a False v2a); \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; isValidVTableRoot (cteCap cted); ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a\<rbrakk> \<Longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cted)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cted)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cted)) = global.capUntypedPtr (cteCap cted))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cted))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cted)) s
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; capAligned (capability.ReplyCap v0a False v2a); \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; isValidVTableRoot (cteCap cted); ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; valid_cap' (cteCap cted) s\<rbrakk> \<Longrightarrow> page_directory_at' (global.capUntypedPtr (cteCap cted)) s \<and> valid_pde_mappings' s \<and> (\<forall>shw_asid. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (global.capUntypedPtr (cteCap cted)) = set_option (pde_stored_asid shw_asid) \<and> pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0 \<longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_pde_mappings' s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10 \<and> capPDBasePtr (capCap (cteCap cted)) = global.capUntypedPtr (cteCap cted))) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cted))) = set_option (pde_stored_asid shw_asid)) \<and> page_directory_at' (global.capUntypedPtr (cteCap cted)) s
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = set_option (pde_stored_asid shw_asid); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0\<rbrakk> \<Longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10)
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + tcbCTableSlot * 0x10) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + tcbCallerSlot * 0x10) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + tcbVTableSlot * 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = set_option (pde_stored_asid shw_asid); pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb' s\<rbrakk> \<Longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive v0 v4) s \<and> valid_cap' (cteCap makeObject) s \<and> valid_mdb_ctes (ctes_of s) \<and> unat (msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister))) \<le> length TCB_H.msgRegisters \<and> (\<exists>v. set_option (pde_stored_asid shw_asid) = {v}) \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> ksCurThread s + tcbCallerSlot * 0x10 \<noteq> v0a + tcbVTableSlot * 0x10)
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s)\<rbrakk> \<Longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> 0x20 + ksCurThread s \<noteq> v0a)
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s\<rbrakk> \<Longrightarrow> tcbDomain tcba \<le> maxDomain \<and> (tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> 0x20 + ksCurThread s \<noteq> v0a)
A total of 2 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s\<rbrakk> \<Longrightarrow> tcbDomain tcba \<le> maxDomain
A total of 3 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; Structures_H.thread_state.Running = tcbState tcb_; tcbs_of s_ (ksCurThread s_) = Some tcb_; cptr = atcbContextGet (tcbArch tcb_) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s_)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s_; valid_queues_no_bitmap s_; valid_bitmapQ s_; bitmapQ_no_L2_orphans s_; bitmapQ_no_L1_orphans s_; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)); tcbFault tcb_ = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s_ (ksCurThread s_) = Some cte_; tcb_ntfn_is_bound' ntfnptr_ tcb_; state_refs_of' s_ (ksCurThread s_) = tcb_bound_refs' ntfnptr_; ctes_of s_ a_ = Some ctea_; v3_; case tcbBoundNotification tcb_ of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s_; \<not> rv_; ctes_of s_ (ksCurThread s_ + 0x30) = Some cteb_; valid_cap' (cteCap ctec_) s_; cteCap ctea_ = capability.EndpointCap v0_ v1_ v2_ True v4_ v5_; ep_at' v0_ s_; ko_at' ep_ v0_ s_; \<not> isSendEP ep_; \<not> v1a_; cteCap cteb_ = capability.ReplyCap v0a_ False v2a_; tcbs_of s_ v0a_ = Some tcba_; tcbFault tcba_ = None; ctes_of s_ (v0a_ + 0x10) = Some cted_; ptr_val (tcb_ptr_to_ctcb_ptr v0a_) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a_; is_aligned v0_ (objBits undefined); objBits undefined < word_bits; is_aligned v0a_ (objBits undefined); objBits undefined < word_bits; cteCap cted_ = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c_ (Some y_)); is_aligned v0c_ 14; 14 < word_bits; page_directory_at' v0c_ s_; 0 < y_; y_ < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s_)) v0c_ = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid_))}; pde_get_tag shw_asid_ = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid_) \<noteq> 0; valid_mdb_ctes (ctes_of s_); valid_ep' ep_ s_\<rbrakk> \<Longrightarrow> tcbDomain tcba_ \<le> maxDomain proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; Structures_H.thread_state.Running = tcbState tcb_; tcbs_of s_ (ksCurThread s_) = Some tcb_; cptr = atcbContextGet (tcbArch tcb_) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s_)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s_; valid_queues_no_bitmap s_; valid_bitmapQ s_; bitmapQ_no_L2_orphans s_; bitmapQ_no_L1_orphans s_; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)); tcbFault tcb_ = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb_) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s_ (ksCurThread s_) = Some cte_; tcb_ntfn_is_bound' ntfnptr_ tcb_; state_refs_of' s_ (ksCurThread s_) = tcb_bound_refs' ntfnptr_; ctes_of s_ a_ = Some ctea_; v3_; case tcbBoundNotification tcb_ of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s_; \<not> rv_; ctes_of s_ (ksCurThread s_ + 0x30) = Some cteb_; valid_cap' (cteCap ctec_) s_; cteCap ctea_ = capability.EndpointCap v0_ v1_ v2_ True v4_ v5_; ep_at' v0_ s_; ko_at' ep_ v0_ s_; \<not> isSendEP ep_; \<not> v1a_; cteCap cteb_ = capability.ReplyCap v0a_ False v2a_; tcbs_of s_ v0a_ = Some tcba_; tcbFault tcba_ = None; ctes_of s_ (v0a_ + 0x10) = Some cted_; ptr_val (tcb_ptr_to_ctcb_ptr v0a_) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a_; is_aligned v0_ (objBits undefined); objBits undefined < word_bits; is_aligned v0a_ (objBits undefined); objBits undefined < word_bits; cteCap cted_ = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c_ (Some y_)); is_aligned v0c_ 14; 14 < word_bits; page_directory_at' v0c_ s_; 0 < y_; y_ < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s_)) v0c_ = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid_))}; pde_get_tag shw_asid_ = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid_) \<noteq> 0; valid_mdb_ctes (ctes_of s_); valid_ep' ep_ s_\<rbrakk> \<Longrightarrow> tcbDomain tcba_ \<le> maxDomain proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s\<rbrakk> \<Longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> 0x20 + ksCurThread s \<noteq> v0a
A total of 2 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s \<and> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})) \<and> 0x20 + ksCurThread s \<noteq> v0a
A total of 2 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s\<rbrakk> \<Longrightarrow> valid_ep' (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread s]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread s]) s
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid x1. \<lbrakk>\<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1; tcbDomain tcba = ksCurDomain s; (s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' (Structures_H.endpoint.RecvEP x1) v0 s; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ksCurThread s \<notin> set x1
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 tcba v0a v1a v2a cted y v0c shw_asid x1. \<lbrakk>\<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); tcbDomain tcba = ksCurDomain s; (s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; x1 \<noteq> []; \<forall>t\<in>set x1. tcb_at' t s; distinct x1\<rbrakk> \<Longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s
A total of 4 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)}))
A total of 3 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s; sym_refs (state_refs_of' s)\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)}))
A total of 3 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s\<rbrakk> \<Longrightarrow> state_refs_of' s = (state_refs_of' s)(ksCurThread s := {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)})
A total of 3 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s\<rbrakk> \<Longrightarrow> state_refs_of' s (ksCurThread s) = {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr \<and> snd r = TCBBound)}
A total of 3 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = set_option ntfnptr \<times> {TCBBound}; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s\<rbrakk> \<Longrightarrow> set_option ntfnptr \<times> {TCBBound} = {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r \<in> set_option ntfnptr \<times> {TCBBound} \<and> snd r = TCBBound)}
A total of 3 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid aa. \<lbrakk>(s, s') \<in> rf_sr; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' (Some aa) tcb; state_refs_of' s (ksCurThread s) = {(aa, TCBBound)}; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s; ntfnptr = Some aa\<rbrakk> \<Longrightarrow> {(aa, TCBBound)} = {r. snd r = TCBBound \<and> (r = (v0, TCBBlockedRecv) \<or> r = (aa, TCBBound) \<and> snd r = TCBBound)}
A total of 3 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb cte ntfnptr a ctea rv cteb v0 ctec v1 v2 v3 v4 v5 ep tcba v0a v1a v2a cted y v0c shw_asid. \<lbrakk>(s, s') \<in> rf_sr; invs' s; Structures_H.thread_state.Running = tcbState tcb; tcbs_of s (ksCurThread s) = Some tcb; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread s)) && ~~ (2 ^ tcbBlockSizeBits - 1) = ksCurThread s; valid_queues_no_bitmap s; valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = mi_from_H (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)); tcbFault tcb = None; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s) = Some cte; tcb_ntfn_is_bound' ntfnptr tcb; state_refs_of' s (ksCurThread s) = tcb_bound_refs' ntfnptr; ctes_of s a = Some ctea; v3; case tcbBoundNotification tcb of None \<Rightarrow> True | Some p \<Rightarrow> obj_at' (\<lambda>ntfn. \<not> EndpointDecls_H.isActive ntfn) p s; \<not> rv; ctes_of s (ksCurThread s + 0x30) = Some cteb; valid_cap' (cteCap ctec) s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; tcbs_of s v0a = Some tcba; tcbFault tcba = None; ctes_of s (v0a + 0x10) = Some cted; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && ~~ (2 ^ tcbBlockSizeBits - 1) = v0a; is_aligned v0 (objBits undefined); objBits undefined < word_bits; is_aligned v0a (objBits undefined); objBits undefined < word_bits; cteCap cted = capability.ArchObjectCap (arch_capability.PageDirectoryCap v0c (Some y)); is_aligned v0c 14; 14 < word_bits; page_directory_at' v0c s; 0 < y; y < 2 ^ local.asid_bits; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) v0c = {UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift shw_asid))}; pde_get_tag shw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; stored_asid_valid_CL (pde_pde_invalid_lift shw_asid) \<noteq> 0; valid_mdb_ctes (ctes_of s); valid_ep' ep s; tcbDomain tcba = ksCurDomain s\<rbrakk> \<Longrightarrow> 0x20 + ksCurThread s \<noteq> v0a
A total of 2 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>msgInfo cptra s s'. \<lbrakk>msgInfo = msginfo; cptra = cptr; (s, s') \<in> rf_sr; invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s'. \<forall>rva. s' \<in> {s'. \<forall>rvb. s' \<in> {s. \<forall>v. v = seL4_MessageInfo_C (ARRAY a. K (w_' (w_'_update (\<lambda>_. rva) s)) a) \<longrightarrow> info_'_update (\<lambda>_. v) s \<in> {s. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. v) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> (\<forall>rvb. (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault) = (rvb = None) \<longrightarrow> (\<forall>vb. (vb = 0) = (msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord rva)) \<longrightarrow> ((msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord rva) \<longrightarrow> (\<exists>y. rvb = Some y)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (msgExtraCaps (messageInfoFromWord rva) = 0 \<and> msgLength (messageInfoFromWord rva) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<and> seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord rva) \<and> rvb = None \<longrightarrow> msgLength (messageInfoFromWord rva) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. (\<exists>cte'. cslift s (cte_Ptr (rv + 2 ^ cte_level_bits * tcbCTableSlot)) = Some cte' \<and> ccte_relation cte cte') \<longrightarrow> ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rvb. ccap_relation (case rvb of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t) \<longrightarrow> (isLeft rvb \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = vb) \<and> (\<not> isEndpointCap (theRight rvb) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv \<and> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = vb) \<and> (isRight rvb \<and> isEndpointCap (theRight rvb) \<longrightarrow> (\<not> capEPCanReceive (theRight rvb) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (capEPCanReceive (theRight rvb) \<longrightarrow> (\<exists>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>rvb. (if notification_CL.state_CL (notification_lift (the (cslift s (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else vb) = from_bool rvb \<longrightarrow> (rvb \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rvb \<longrightarrow> (\<forall>ta rvb. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rvb \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr \<and> ko_at' rvb (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rvb \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> vb then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> vb <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = rv + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries)))) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(notification_C ptr) &(ksCurThread_' (globals s)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<forall>rvb. from_bool rvb = vb \<longrightarrow> (rvb \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.SysReplyRecv = syscall_from_H syscall.SysReplyRecv) \<and> (\<not> rvb \<longrightarrow> (\<forall>ta rvb. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rvb \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr \<and> ko_at' rvb (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) sa \<and> valid_objs' sa) \<longrightarrow> \<not> isSendEP rvb \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>sa. (sa, s\<lparr>length___unsigned_long_' := va, ret__unsigned_' := seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbFault_C''])))\<rparr>) \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>ta. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' ta = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' ta) = Some stored_hw_asid \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> vb then ksCurDomain_' (globals s) else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) \<and> ((\<exists>t. ret__unsigned_long_' t \<noteq> 0) \<longrightarrow> stored_asid_valid_CL (pde_pde_invalid_lift stored_hw_asid) \<noteq> 0 \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbDomain_C''])) = ksCurDomain_' (globals s) \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries))))) \<and> (\<not> vb <s maxDom \<longrightarrow> (\<forall>ta. ta \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>tb. (\<exists>thread_state. thread_state_lift thread_state = thread_state_lift (tcbState_C (the (cslift ta (ksCurThread_' (globals s)))))\<lparr>blockingIPCCanGrant_CL := capCanGrant_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t)) && 1\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ksCurThread_' (globals s)) (tcbState_C_update (\<lambda>_. thread_state) (the (cslift ta (ksCurThread_' (globals s)))))) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>t. (ret__unsigned_' t = 0 \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries) \<and> (ret__unsigned_' t \<noteq> 0 \<longrightarrow> tb \<Turnstile>\<^sub>c tcb_Ptr (ret__unsigned_' t) \<longrightarrow> tb \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> (\<forall>t rvb. mdbPrev_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals t))) (mdb_Ptr &(cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cteMDBNode_C''])))) = mdbPrev (cteMDBNode rvb) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr (mdbPrev (cteMDBNode rvb)) \<longrightarrow> (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> (\<exists>t. t \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)))) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>) \<longrightarrow> va = msgLength (messageInfoFromWord rva) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> tcbCallerSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries)))))))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' ta = global.capUntypedPtr (cteCap ctea))) \<and> (ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00) + tcbVTableSlot * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr (cteCap cte) + 2 ^ cte_level_bits * tcbVTableSlot \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries \<and> tcbVTableSlot < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbVTableSlot) \<le> uint tcbCNodeEntries) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (ptr_val (ksCurThread_' (globals s)) && 0xFFFFFE00) + tcbCallerSlot * word_of_nat (size_of TYPE(cte_C)) = rv + 2 ^ cte_level_bits * tcbCallerSlot \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> 0 \<le> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<and> sint (SCAST(32 \<rightarrow> 32 signed) tcbCallerSlot) \<le> uint tcbCNodeEntries))))) \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries) \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint Kernel_C.tcbCTable \<and> sint Kernel_C.tcbCTable \<le> uint tcbCNodeEntries)))))}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>s s' t rv cte cte'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s); ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = mi_from_H (messageInfoFromWord rv); msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cslift s' (cte_Ptr (ksCurThread s)) = Some cte'; ccte_relation cte cte'\<rbrakk> \<Longrightarrow> ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (ksCurThread s)\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rv. ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t) \<longrightarrow> (isLeft rv \<longrightarrow> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (\<not> isEndpointCap (theRight rv) \<longrightarrow> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (isRight rv \<and> isEndpointCap (theRight rv) \<longrightarrow> (capEPCanReceive (theRight rv) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>rv. (if notification_CL.state_CL (notification_lift (the (cslift s' (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)))) \<and> (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<forall>rv. from_bool rv = 0 \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap))))) \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' t rv cte cte'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s); ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = mi_from_H (messageInfoFromWord rv); msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cslift s' (cte_Ptr (ksCurThread s)) = Some cte'; ccte_relation cte cte'; \<exists>tcb tcb' ntfn ntfn'. ko_at' tcb (ksCurThread s) s \<and> (atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msginfo) \<and> cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb' \<and> ctcb_relation tcb tcb' \<and> (tcbBoundNotification_C tcb' = NULL) = (tcbBoundNotification tcb = None) \<and> (tcbBoundNotification tcb \<noteq> None \<longrightarrow> ko_at' ntfn (the (tcbBoundNotification tcb)) s) \<and> (tcbBoundNotification tcb \<noteq> None \<longrightarrow> cslift s' (tcbBoundNotification_C tcb') = Some ntfn') \<and> (tcbBoundNotification tcb \<noteq> None \<longrightarrow> cnotification_relation (cslift s') ntfn ntfn')\<rbrakk> \<Longrightarrow> ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (ksCurThread s)\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rv. ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t) \<longrightarrow> (isLeft rv \<longrightarrow> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (\<not> isEndpointCap (theRight rv) \<longrightarrow> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (isRight rv \<and> isEndpointCap (theRight rv) \<longrightarrow> (capEPCanReceive (theRight rv) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])) \<and> (\<forall>rv. (if notification_CL.state_CL (notification_lift (the (cslift s' (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])))))) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)))) \<and> (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbBoundNotification_C''])) = NULL \<longrightarrow> (\<forall>rv. from_bool rv = 0 \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap))))) \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' t rv cte cte' tcb tcb' ntfn ntfn'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; obj_at' (\<lambda>tcba. atcbContextGet (tcbArch tcba) Thread_H.capRegister = atcbContextGet (tcbArch tcb) Thread_H.capRegister \<and> atcbContextGet (tcbArch tcba) TCB_H.msgInfoRegister = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister) (ksCurThread s) s; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; seL4_Fault_get_tag (tcbFault_C tcb') = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = mi_from_H (messageInfoFromWord rv); msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cslift s' (cte_Ptr (ksCurThread s)) = Some cte'; ccte_relation cte cte'; ko_at' tcb (ksCurThread s) s; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; (tcbBoundNotification_C tcb' = NULL) = (tcbBoundNotification tcb = None); (\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> ko_at' ntfn (the (tcbBoundNotification tcb)) s; (\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> cslift s' (tcbBoundNotification_C tcb') = Some ntfn'; (\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> cnotification_relation (cslift s') ntfn ntfn'\<rbrakk> \<Longrightarrow> ccap_relation (cteCap cte) (cte_C.cap_C cte') \<and> (\<forall>t rv. ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t) \<longrightarrow> (isLeft rv \<longrightarrow> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (\<not> isEndpointCap (theRight rv) \<longrightarrow> of_bl [cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap] = 0) \<and> (isRight rv \<and> isEndpointCap (theRight rv) \<longrightarrow> (capEPCanReceive (theRight rv) \<longrightarrow> (\<exists>tcb. ctcb_relation tcb tcb') \<longrightarrow> ((\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> (\<forall>rv. (if notification_CL.state_CL (notification_lift ntfn') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)))) \<and> (tcbBoundNotification tcb = None \<longrightarrow> (\<forall>rv. from_bool rv = 0 \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>ta rv. (ret__unsigned_' ta = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' t))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> 4081 \<le> 2 ^ (pdBits - 2) \<and> 4080 \<le> 2 ^ (pdBits - 2) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap))))) \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' t rv cte cte' tcb tcb' ntfn ntfn' ta rva tcba. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; obj_at' (\<lambda>tcba. atcbContextGet (tcbArch tcba) Thread_H.capRegister = atcbContextGet (tcbArch tcb) Thread_H.capRegister \<and> atcbContextGet (tcbArch tcba) TCB_H.msgInfoRegister = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister) (ksCurThread s) s; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; seL4_Fault_get_tag (tcbFault_C tcb') = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = \<lparr>label_CL = msgLabel (messageInfoFromWord rv), capsUnwrapped_CL = msgCapsUnwrapped (messageInfoFromWord rv), extraCaps_CL = 0, length_CL = msgLength (messageInfoFromWord rv)\<rparr>; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cslift s' (cte_Ptr (ksCurThread s)) = Some cte'; ko_at' tcb (ksCurThread s) s; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; (tcbBoundNotification_C tcb' = NULL) = (tcbBoundNotification tcb = None); (\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> ko_at' ntfn (the (tcbBoundNotification tcb)) s; (\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> cslift s' (tcbBoundNotification_C tcb') = Some ntfn'; (\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> cnotification_relation (cslift s') ntfn ntfn'; ccap_relation (cteCap cte) (cte_C.cap_C cte'); mdb_node_to_H (mdb_node_lift (cteMDBNode_C cte')) = cteMDBNode cte; ccap_relation (theRight rva) (ret__struct_cap_C_' ta); isRight rva; isEndpointCap (theRight rva); capEPCanReceive (theRight rva); ctcb_relation tcba tcb'\<rbrakk> \<Longrightarrow> ((\<exists>y. tcbBoundNotification tcb = Some y) \<longrightarrow> (\<forall>rv. (if notification_CL.state_CL (notification_lift ntfn') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>t rv. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' ta))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte))))) \<and> (tcbBoundNotification tcb = None \<longrightarrow> (\<forall>rv. from_bool rv = 0 \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>t rv. (ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) EPState_Send) = isSendEP rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' rv (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' ta))) s \<and> valid_objs' s) \<longrightarrow> \<not> isSendEP rv \<longrightarrow> (\<forall>cte cap. ccap_relation (cteCap cte) cap \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> capAligned (cteCap cte) \<longrightarrow> (\<exists>t. \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' t = from_bool (isReplyCap capa \<and> \<not> capReplyMaster capa)) \<longrightarrow> isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte)) \<longrightarrow> (\<forall>ctea cap. ccap_relation (cteCap ctea) cap \<longrightarrow> (\<forall>t. (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift cap)) \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> ((\<exists>stored_hw_asid. pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' t) = Some stored_hw_asid) \<longrightarrow> (\<exists>rv. (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb))) \<and> ret__unsigned_' t = global.capUntypedPtr (cteCap ctea))) \<and> ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (cteCap cte))) && 0xFFFFFE00 = capTCBPtr (cteCap cte))))) proof (prove)
goal (2 subgoals):
 1. \<And>s s' t rv cte cte' tcb tcb' ntfn ntfn' ta tcba rvb tb rvc ctea cap cteb capa tc tcbb v0 ya sa td stored_hw_asid rvd ctcb v1 v2 v3 v4 v5 sb v0a v1a v2a yb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; obj_at' (\<lambda>tcba. atcbContextGet (tcbArch tcba) Thread_H.capRegister = atcbContextGet (tcbArch tcb) Thread_H.capRegister \<and> atcbContextGet (tcbArch tcba) TCB_H.msgInfoRegister = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister) (ksCurThread s) s; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; seL4_Fault_get_tag (tcbFault_C tcb') = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> SCAST(32 signed \<rightarrow> 32) n_msgRegisters; seL4_MessageInfo_lift (seL4_MessageInfo_C (ARRAY i. rv)) = \<lparr>label_CL = msgLabel (messageInfoFromWord rv), capsUnwrapped_CL = msgCapsUnwrapped (messageInfoFromWord rv), extraCaps_CL = 0, length_CL = msgLength (messageInfoFromWord rv)\<rparr>; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cslift s' (cte_Ptr (ksCurThread s)) = Some cte'; ko_at' tcb (ksCurThread s) s; cptr = atcbContextGet (tcbArch tcb) Thread_H.capRegister; msginfo = atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some tcb'; ctcb_relation tcb tcb'; tcbBoundNotification_C tcb' \<noteq> NULL; ko_at' ntfn ya s; cslift s' (tcbBoundNotification_C tcb') = Some ntfn'; cnotification_relation (cslift s') ntfn ntfn'; ccap_relation (cteCap cte) (cte_C.cap_C cte'); mdb_node_to_H (mdb_node_lift (cteMDBNode_C cte')) = cteMDBNode cte; ccap_relation (capability.EndpointCap v0 v1 v2 True v4 v5) (ret__struct_cap_C_' ta); v3; ctcb_relation tcba tcb'; (if notification_CL.state_CL (notification_lift ntfn') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active then 1 else 0) = false; \<not> rvb; ret__unsigned_' tb \<noteq> SCAST(32 signed \<rightarrow> 32) EPState_Send; \<not> isSendEP rvc; ccap_relation (capability.ReplyCap v0a False v2a) cap; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap (ret__unsigned_' tc) (Some yb))) capa; tcbBoundNotification tcb = Some ya; \<forall>capa. ccap_relation capa cap \<longrightarrow> ret__int_' td = from_bool ((\<exists>v0 v1 v2. capa = capability.ReplyCap v0 v1 v2) \<and> \<not> capReplyMaster capa); (if maxDom \<noteq> 0 then ksCurDomain_' (globals s') else 0) = UCAST(8 \<rightarrow> 32) rvd; (sb, s') \<in> rf_sr; \<not> v1a; cteCap ctea = capability.ReplyCap v0a False v2a; (sa, s') \<in> rf_sr; pde_get_tag stored_hw_asid = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; (cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) (ret__unsigned_' tc) = Some stored_hw_asid; cslift s' (tcb_ptr_to_ctcb_ptr v0a) = Some ctcb; ctcb_relation tcbb ctcb; 9 < word_bits; ko_at' rvc (capEPPtr_CL (cap_endpoint_cap_lift (ret__struct_cap_C_' ta))) sa; valid_objs' sa; ptr_val (tcb_ptr_to_ctcb_ptr v0a) && 0xFFFFFE00 = v0a; cteCap cteb = capability.ArchObjectCap (arch_capability.PageDirectoryCap (ret__unsigned_' tc) (Some yb))\<rbrakk> \<Longrightarrow> tcbPriority_C ctcb = UCAST(8 \<rightarrow> 32) (tcbPriority tcbb)
A total of 2 subgoals... proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres dc xfdc (\<lambda>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr \<and> (atcbContextGet \<circ> tcbArch) tcb TCB_H.msgInfoRegister = msginfo) (ksCurThread s) s) (UNIV \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace> \<inter> \<lbrace>\<acute>msgInfo = msginfo\<rbrace>) [] (fastpaths syscall.SysReplyRecv) (Call fastpath_reply_recv_'proc)

goal:
No subgoals!