theory Ipc_C

lemma doReplyTransfer_ccorres [corres]:
  "ccorres dc xfdc
    (invs' and st_tcb_at' (Not \<circ> isReply) sender
        and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain)
        and ((Not o real_cte_at' slot) or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot)
        and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte))
         slot)
    (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace>
          \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>
          \<inter> \<lbrace>\<acute>slot = Ptr slot\<rbrace>
          \<inter> \<lbrace>\<acute>grant = from_bool grant\<rbrace>)  hs
    (doReplyTransfer sender receiver slot grant)
    (Call doReplyTransfer_'proc)" proof - have invs_valid_queues_strg: "\<And>s. invs' s \<longrightarrow> valid_queues s" by clarsimp show ?thesis apply (cinit lift: sender_' receiver_' slot_' grant_') apply (rule getThreadState_ccorres_foo) apply (rule ccorres_assert2) apply (simp add: liftM_def getSlotCap_def
               del: Collect_const split del: if_split) apply (rule ccorres_pre_getCTE) apply (rule ccorres_assert2) apply (rule ccorres_pre_getCTE) apply (rule ccorres_assert2) apply (rule ccorres_pre_threadGet) apply (rename_tac fault) apply (rule ccorres_move_c_guard_tcb) apply (rule_tac val="case_option (scast seL4_Fault_NullFault) fault_to_fault_tag fault"
               and xf'=ret__unsigned_'
               and R="\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = fault"
                in ccorres_symb_exec_r_known_rv_UNIV [where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_tcb]) apply (fastforce simp: ctcb_relation_def typ_heap_simps
                            cfault_rel_def seL4_Fault_lift_def Let_def
                     split: if_split_asm option.split) apply ceqv apply csymbr apply wpc apply (clarsimp simp: ccorres_cond_iffs split del: if_split) apply (rule ccorres_rhs_assoc)+ apply (ctac(no_vcg)) apply (rule ccorres_symb_exec_r) apply (ctac(no_vcg) add: cteDeleteOne_ccorres[where w="scast cap_reply_cap"]) apply (ctac(no_vcg) add: setThreadState_ccorres) apply (ctac(no_vcg) add: possibleSwitchTo_ccorres) apply (wpsimp wp: sts_running_valid_queues setThreadState_st_tcb)+ apply (wp cteDeleteOne_sch_act_wf) apply vcg apply (rule conseqPre, vcg) apply (simp(no_asm_use) add: gs_set_assn_Delete_cstate_relation[unfolded o_def]
                                   subset_iff rf_sr_def) apply wp apply (simp add: cap_get_tag_isCap) apply (strengthen invs_weak_sch_act_wf_strg
                       cte_wp_at_imp_consequent'[where P="\<lambda>ct. Ex (ccap_relation (cteCap ct))" for ct]
                       invs_valid_queues_strg) apply (simp add: cap_reply_cap_def) apply (wp doIPCTransfer_reply_or_replyslot) apply (clarsimp simp: seL4_Fault_NullFault_def ccorres_cond_iffs
                          fault_to_fault_tag_nonzero
               split del: if_split) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_symb_exec_r) apply (ctac (no_vcg) add: cteDeleteOne_ccorres[where w="scast cap_reply_cap"]) apply (rule_tac A'=UNIV in stronger_ccorres_guard_imp) apply (rule ccorres_split_nothrow_novcg [OF ccorres_call,
                                                  OF handleFaultReply_ccorres,
                                                  unfolded bind_assoc,
                                                  where xf'=restart_']) apply simp_all[3] apply ceqv apply csymbr apply (rule ccorres_split_nothrow_novcg) apply (rule threadSet_ccorres_lemma2[where P=\<top>]) apply vcg apply (clarsimp simp: typ_heap_simps') apply (erule(1) rf_sr_tcb_update_no_queue2,
                      (simp add: typ_heap_simps')+, simp_all?)[1] apply (rule ball_tcb_cte_casesI, simp+) apply (clarsimp simp: ctcb_relation_def
                                     seL4_Fault_lift_NullFault
                                     cfault_rel_def is_cap_fault_def
                                     cthread_state_relation_def) apply (case_tac "tcbState tcb", simp_all add: is_cap_fault_def)[1] apply ceqv apply (rule_tac R=\<top> in ccorres_cond2) apply (clarsimp simp: to_bool_def Collect_const_mem) apply (ctac (no_vcg)) apply (simp only: K_bind_def) apply (ctac add: possibleSwitchTo_ccorres) apply (wp sts_running_valid_queues setThreadState_st_tcb | simp)+ apply (ctac add: setThreadState_ccorres_valid_queues'_simple) apply wp apply ((wp threadSet_valid_queues threadSet_sch_act threadSet_valid_queues' hoare_weak_lift_imp
                       threadSet_valid_objs' threadSet_weak_sch_act_wf
                         | simp add: valid_tcb_state'_def)+)[1] apply (clarsimp simp: guard_is_UNIV_def ThreadState_Restart_def
                                 ThreadState_Inactive_def mask_def
                                 option_to_ctcb_ptr_def) apply (rule_tac Q="\<lambda>rv. valid_queues and tcb_at' receiver and valid_queues' and
                                valid_objs' and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and
                                (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)" in hoare_post_imp) apply (clarsimp simp: inQ_def weak_sch_act_wf_def) apply (wp threadSet_valid_queues threadSet_sch_act handleFaultReply_sch_act_wf) apply (clarsimp simp: guard_is_UNIV_def) apply assumption apply clarsimp apply (drule_tac p=receiver in obj_at_ko_at') apply clarsimp apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_tcb]) apply (clarsimp simp: ctcb_relation_def typ_heap_simps) apply wp apply (strengthen vp_invs_strg' invs_valid_queues') apply (wp cteDeleteOne_tcbFault cteDeleteOne_sch_act_wf) apply vcg apply (rule conseqPre, vcg) apply (simp(no_asm_use) add: gs_set_assn_Delete_cstate_relation[unfolded o_def]
                                 subset_iff rf_sr_def) apply (clarsimp simp: guard_is_UNIV_def option_to_ptr_def option_to_0_def
                         ThreadState_Running_def mask_def
                         ghost_assertion_data_get_def ghost_assertion_data_set_def
                         cap_tag_defs option_to_ctcb_ptr_def
                  split: option.splits) apply (clarsimp simp: pred_tcb_at' invs_valid_objs') apply (clarsimp simp: pred_tcb_at'_def obj_at'_def cte_wp_at_ctes_of
                        cap_get_tag_isCap) apply fastforce done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool grant\<rbrace>) hs (doReplyTransfer sender receiver slot grant) (Call doReplyTransfer_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool grant\<rbrace>) hs (doReplyTransfer sender receiver slot grant) (Call doReplyTransfer_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s. invs' s \<longrightarrow> Invariants_H.valid_queues s proof (state)
this:
invs' ?s1 \<longrightarrow> Invariants_H.valid_queues ?s1

goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool grant\<rbrace>) hs (doReplyTransfer sender receiver slot grant) (Call doReplyTransfer_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool grant\<rbrace>) hs (doReplyTransfer sender receiver slot grant) (Call doReplyTransfer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1818 granta slota receivera sendera) (?Q'1818 granta slota receivera sendera) (SKIP # hs) (do state <- getThreadState receiver;
y <- assert (isReply state);
mdbNode <- liftM cteMDBNode (getCTE slot);
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c receivera} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(receivera\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(sendera,PTR_COERCE(unit \<rightarrow> endpoint_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) 0,granta,receivera);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(slota);;
CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(receivera)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(slota);;
\<acute>restart :== CALL handleFaultReply_'proc(receivera,sendera);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c receivera} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(receivera\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(receivera)
ELSE
  CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1818 granta slota receivera sendera s \<and> s' \<in> ?Q'1818 granta slota receivera sendera proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1824 granta slota receivera sendera rv) (?P'1824 granta slota receivera sendera rv) (SKIP # hs) (do y <- assert (isReply rv);
mdbNode <- liftM cteMDBNode (getCTE slot);
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c receivera} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(receivera\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(sendera,PTR_COERCE(unit \<rightarrow> endpoint_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) 0,granta,receivera);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(slota);;
CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(receivera)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(slota);;
\<acute>restart :== CALL handleFaultReply_'proc(receivera,sendera);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c receivera} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(receivera\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(receivera)
ELSE
  CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> ?P1824 granta slota receivera sendera ts s) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'1824 granta slota receivera sendera ts} proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G1826 granta slota receivera sendera rv) (?G'1826 granta slota receivera sendera rv) (SKIP # hs) (do mdbNode <- liftM cteMDBNode (getCTE slot);
y <- assert (mdbPrev mdbNode \<noteq> nullPointer \<and> mdbNext mdbNode = nullPointer);
parentCap <- getSlotCap (mdbPrev mdbNode);
y <- assert (isReplyCap parentCap \<and> capReplyMaster parentCap);
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c receivera} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(receivera\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(sendera,PTR_COERCE(unit \<rightarrow> endpoint_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) 0,granta,receivera);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(slota);;
CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(receivera)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(slota);;
\<acute>restart :== CALL handleFaultReply_'proc(receivera,sendera);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c receivera} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(receivera\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(receivera)
ELSE
  CALL setThreadState_'proc(receivera,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> ?G1826 granta slota receivera sendera ts s) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> ?G'1826 granta slota receivera sendera ts}} proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G1826 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv) (?G'1826 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv) (SKIP # hs) (do x <- getCTE slot;
y <- assert (mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer);
cte <- getCTE (mdbPrev (cteMDBNode x));
y <- assert (isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte));
threadGet tcbFault receiver >>= case_option (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<lambda>f. do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> ?G1826 granta slota receivera sendera ts s) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> ?G'1826 granta slota receivera sendera ts}} proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P1835 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv a x) (?P'1837 rv x) (SKIP # hs) (do y <- assert (mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer);
cte <- getCTE (mdbPrev (cteMDBNode x));
y <- assert (isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte));
a <- threadGet tcbFault receiver;
case a of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ?P1835 granta slota receivera sendera ts s cte)) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?P'1836 granta slota receivera sendera ts cte'}}}
flex-flex pairs:
\<lambda>rv cte'. ?P'1837 rv (cte_to_H cte') \<equiv>\<^sup>? ?P'1836 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G1847 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x) (?G'1845 rv x) (SKIP # hs) (do cte <- getCTE (mdbPrev (cteMDBNode x));
y <- assert (isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte));
a <- threadGet tcbFault receiver;
case a of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> ?G1847 granta slota receivera sendera ts cte s)) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> ?G'1846 granta slota receivera sendera ts cte'}}}}
flex-flex pairs:
?G'1846 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv cte'. ?G'1845 rv (cte_to_H cte') proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x rva. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P1853 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x a rva) (?P'1855 rv x rva) (SKIP # hs) (do y <- assert (isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva));
a <- threadGet tcbFault receiver;
case a of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> ?P1853 granta slota receivera sendera ts cte s ctea))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> ?P'1856 granta slota receivera sendera ts cte' cte'a}}}}}
flex-flex pairs:
?P'1856 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv cte' cte'a. ?P'1855 rv (cte_to_H cte') (cte_to_H cte'a) proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x rva. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G1866 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva) (?G'1864 rv x rva) (SKIP # hs) (do a <- threadGet tcbFault receiver;
case a of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> ?G1866 granta slota receivera sendera ts cte ctea s))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> ?G'1865 granta slota receivera sendera ts cte' cte'a}}}}}}
flex-flex pairs:
?G'1865 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv cte' cte'a. ?G'1864 rv (cte_to_H cte') (cte_to_H cte'a) proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x rva rvb. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1876 rv x rva rvb) (?P'1874 rv x rva rvb) (SKIP # hs) (case rvb of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ?P1872 granta slota receivera sendera ts cte ctea s tcb)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> ?P'1875 granta slota receivera sendera ts cte' cte'a tcb}}}}}}}
flex-flex pairs:
\<lambda>rv x rva s tcb. ?P1876 rv x rva (tcbFault tcb) s \<equiv>\<^sup>? ?P1872 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)
?P'1875 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv cte' cte'a tcb. ?P'1874 rv (cte_to_H cte') (cte_to_H cte'a) (tcbFault tcb) proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1876 rv x rva fault) (?P'1874 rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ?P1872 granta slota receivera sendera ts cte ctea s tcb)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> ?P'1875 granta slota receivera sendera ts cte' cte'a tcb}}}}}}}
flex-flex pairs:
\<lambda>rv x rva s tcb. ?P1876 rv x rva (tcbFault tcb) s \<equiv>\<^sup>? ?P1872 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)
?P'1875 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv cte' cte'a tcb. ?P'1874 rv (cte_to_H cte') (cte_to_H cte'a) (tcbFault tcb) proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1885 rv x rva fault) (?C'1883 rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])));;
(\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> (?A1886 granta slota receivera sendera ts cte ctea tcb and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> ?C'1882 granta slota receivera sendera ts cte' cte'a tcb \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv cte' cte'a tcb. ?C'1883 rv (cte_to_H cte') (cte_to_H cte'a) (tcbFault tcb) \<equiv>\<^sup>? ?C'1882 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)
?A1886 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?A1885 rv x rva (tcbFault tcb) proof (prove)
goal (5 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault s. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (\<exists>t. ko_at' t receiver s \<and> tcbFault t = fault) \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)\<rbrace>)
 2. \<And>granta slota receivera sendera rv x rva fault rv' t t'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI) (?y'1888 granta slota receivera sendera rv x rva fault rv')
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1893 rv x rva fault) (?Q1888 granta slota receivera sendera rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (?y'1888 granta slota receivera sendera rv x rva fault (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x))
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. ?Q1888 granta slota receivera sendera rv x rva fault)
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> (?P1894 granta slota receivera sendera ts cte ctea tcb and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?P1893 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?P1894 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva s xa t. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (s, xa) \<in> rf_sr; ko_at' t receiver s\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))) = (case tcbFault t of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)
 2. \<And>granta slota receivera sendera rv x rva fault rv' t t'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI) (?y'1888 granta slota receivera sendera rv x rva fault rv')
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1893 rv x rva fault) (?Q1888 granta slota receivera sendera rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (?y'1888 granta slota receivera sendera rv x rva fault (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x))
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. ?Q1888 granta slota receivera sendera rv x rva fault)
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> (?P1894 granta slota receivera sendera ts cte ctea tcb and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P1894 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P1893 rv x rva (tcbFault tcb) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva s xa t ko'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); ko_at' t receiver s; cslift xa (tcb_ptr_to_ctcb_ptr receiver) = Some ko'; ctcb_relation t ko'\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C'']))) = (case tcbFault t of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)
 2. \<And>granta slota receivera sendera rv x rva fault rv' t t'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI) (?y'1888 granta slota receivera sendera rv x rva fault rv')
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1893 rv x rva fault) (?Q1888 granta slota receivera sendera rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (?y'1888 granta slota receivera sendera rv x rva fault (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x))
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. ?Q1888 granta slota receivera sendera rv x rva fault)
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> (?P1894 granta slota receivera sendera ts cte ctea tcb and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P1894 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P1893 rv x rva (tcbFault tcb) proof (prove)
goal (4 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault rv' t t'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>fault_type :== \<acute>ret__unsigned;;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI) (?y'1888 granta slota receivera sendera rv x rva fault rv')
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1893 rv x rva fault) (?Q1888 granta slota receivera sendera rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (?y'1888 granta slota receivera sendera rv x rva fault (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x))
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. ?Q1888 granta slota receivera sendera rv x rva fault)
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> (?P1894 granta slota receivera sendera ts cte ctea tcb and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P1894 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P1893 rv x rva (tcbFault tcb) proof (prove)
goal (3 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1893 rv x rva fault) (?Q1888 granta slota receivera sendera rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (\<acute>fault_type :== (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x);;
IF \<acute>fault_type = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. ?Q1888 granta slota receivera sendera rv x rva fault)
 3. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> (?P1894 granta slota receivera sendera ts cte ctea tcb and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P1894 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P1893 rv x rva (tcbFault tcb) proof (prove)
goal (3 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1893 rv x rva fault) (?G'2703 granta slota receivera sendera rv x rva fault) (SKIP # hs) (case fault of None \<Rightarrow> do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od | Some f \<Rightarrow> do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply f receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> ?G'2703 granta slota receivera sendera rv x rva fault})
 3. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> (?P1894 granta slota receivera sendera ts cte ctea tcb and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P1894 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P1893 rv x rva (tcbFault tcb) proof (prove)
goal (4 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3166 rv x rva fault) (?R''3155 granta slota receivera sendera rv x rva fault) (SKIP # hs) (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> ?R''3155 granta slota receivera sendera rv x rva fault} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> ?R3162 granta slota receivera sendera ts cte ctea tcb a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?R3166 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3162 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3166 rv x rva None) (?R''3155 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None) (SKIP # hs) (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> ?R''3155 granta slota receivera sendera rv x rva fault} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> ?R3162 granta slota receivera sendera ts cte ctea tcb a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?R3166 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3162 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3166 rv x rva None) (?R''3155 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None) (SKIP # hs) (do y <- doIPCTransfer sender None 0 grant receiver;
y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
(\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
(CALL cteDeleteOne_'proc(cte_Ptr slot);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)))))
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> ?R''3155 granta slota receivera sendera rv x rva fault} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> ?R3162 granta slota receivera sendera ts cte ctea tcb a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?R3166 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3162 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3195 rv x rva rvb) (?Q'3195 rv x rva rvb xfdca) (SKIP # hs) (do y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
(CALL cteDeleteOne_'proc(cte_Ptr slot);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))))
 2. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>?Q3195 rv x rva\<rbrace>
 3. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3203 granta slota receivera sendera rv x rva fault t rvb}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva. ?Q'3203 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None \<equiv>\<^sup>? \<lambda>rv x rva t rvb. ?Q'3195 rv x rva rvb (xfdc t)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (7 subgoals):
 1. \<And>rv x rva rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3195 rv x rva rvb) (?Q'3243 rv x rva rvb xfdca) (SKIP # hs) (do y <- cteDeleteOne slot;
y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (CALL cteDeleteOne_'proc(cte_Ptr slot);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)))
 2. \<And>rv x rva rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdc) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (?Q'3243 rv x rva rvb xfdc)
 3. \<And>rv x rva rvb xfdc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3195 rv x rva rvb s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>?Q3195 rv x rva\<rbrace>
 5. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 6. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3203 granta slota receivera sendera rv x rva fault t rvb}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 7. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva. ?Q'3203 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None \<equiv>\<^sup>? \<lambda>rv x rva t rvb. ?Q'3195 rv x rva rvb (xfdc t)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (8 subgoals):
 1. \<And>rv x rva rvb xfdca rvc xfdcb. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; dc rvc xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3251 rv x rva rvb xfdca rvc) (?Q'3251 rv x rva rvb xfdca rvc xfdcb) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running receiver;
possibleSwitchTo receiver
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))
 2. \<And>rv x rva rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3255 rv x rva rvb\<rbrace> cteDeleteOne slot \<lbrace>?Q3251 rv x rva rvb xfdc\<rbrace>
 3. \<And>rv x rva rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdca) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3251 rv x rva rvb xfdca rvc (xfdc t)})
 4. \<And>rv x rva rvb xfdc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3255 rv x rva rvb) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3255 rv x rva a\<rbrace>
 6. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 7. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3203 granta slota receivera sendera rv x rva fault t rvb}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 8. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva. ?Q'3203 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None \<equiv>\<^sup>? \<lambda>rv x rva t rvb. ?Q'3195 rv x rva rvb (xfdc t)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (9 subgoals):
 1. \<And>rv x rva rvb xfdca rvc xfdcb rvd xfdcc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3291 rv x rva rvb xfdca rvc xfdcb rvd) (?Q'3291 rv x rva rvb xfdca rvc xfdcb rvd xfdcc) (SKIP # hs) (possibleSwitchTo receiver) (CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))
 2. \<And>rv x rva rvb xfdca rvc xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3295 rv x rva rvb xfdca rvc\<rbrace> setThreadState Structures_H.thread_state.Running receiver \<lbrace>?Q3291 rv x rva rvb xfdca rvc xfdc\<rbrace>
 3. \<And>rv x rva rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3255 rv x rva rvb\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3295 rv x rva rvb xfdc a\<rbrace>
 4. \<And>rv x rva rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdca) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>ta rvd. dc rvd (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'3291 rv x rva rvb xfdca rvc (xfdc t) rvd (xfdc ta)}})
 5. \<And>rv x rva rvb xfdc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3255 rv x rva rvb) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 6. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3255 rv x rva a\<rbrace>
 7. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 8. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3203 granta slota receivera sendera rv x rva fault t rvb}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 9. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva. ?Q'3203 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None \<equiv>\<^sup>? \<lambda>rv x rva t rvb. ?Q'3195 rv x rva rvb (xfdc t)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (8 subgoals):
 1. \<And>rv x rva rvb xfdca rvc xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3295 rv x rva rvb xfdca rvc\<rbrace> setThreadState Structures_H.thread_state.Running receiver \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' receiver and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs'\<rbrace>
 2. \<And>rv x rva rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3255 rv x rva rvb\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R3295 rv x rva rvb xfdc a\<rbrace>
 3. \<And>rv x rva rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdca) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}})
 4. \<And>rv x rva rvb xfdc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3255 rv x rva rvb) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3255 rv x rva a\<rbrace>
 6. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 7. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3203 granta slota receivera sendera rv x rva fault t rvb}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 8. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva. ?Q'3203 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None \<equiv>\<^sup>? \<lambda>rv x rva t rvb. ?Q'3195 rv x rva rvb (xfdc t)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (7 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3398 rv x rva ()\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>rv s. sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s\<rbrace>
 2. \<And>rv x rva rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdca) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}})
 3. \<And>rv x rva rvb xfdc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> ?P'3398 rv x rva rvb a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>b. tcb_at' receiver b \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) b \<and> valid_objs' b \<and> ?P'3398 rv x rva a b)\<rbrace>
 5. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 6. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3203 granta slota receivera sendera rv x rva fault t rvb}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 7. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva. ?Q'3203 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None \<equiv>\<^sup>? \<lambda>rv x rva t rvb. ?Q'3195 rv x rva rvb (xfdc t)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (6 subgoals):
 1. \<And>rv x rva rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdca) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}})
 2. \<And>rv x rva rvb xfdc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3195 rv x rva rvb xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 3. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)\<rbrace>
 4. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 5. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3203 granta slota receivera sendera rv x rva fault t rvb}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 6. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva. ?Q'3203 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva None \<equiv>\<^sup>? \<lambda>rv x rva t rvb. ?Q'3195 rv x rva rvb (xfdc t)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva rvb xfdca s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr slot = cte_Ptr slot \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> tcb_ptr_to_ctcb_ptr receiver = tcb_ptr_to_ctcb_ptr receiver \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> tcb_ptr_to_ctcb_ptr receiver = tcb_ptr_to_ctcb_ptr receiver \<and> True))\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 2. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)\<rbrace>
 3. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva rvb xfdca s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)) s\<rbrakk> \<Longrightarrow> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr slot = cte_Ptr slot \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> tcb_ptr_to_ctcb_ptr receiver = tcb_ptr_to_ctcb_ptr receiver \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> tcb_ptr_to_ctcb_ptr receiver = tcb_ptr_to_ctcb_ptr receiver \<and> True))\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, globals_update (ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)))) sa) \<in> rf_sr}
 2. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)\<rbrace>
 3. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 rv x rva None\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. tcb_at' receiver a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> valid_objs' a)\<rbrace>
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and ?R3208 granta slota receivera sendera ts cte ctea tcb) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3208 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3206 rv x rva (tcbFault tcb)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3440 rv x rva (ds_id None)\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot s \<and> tcb_at' receiver s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s\<rbrace>
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ?P'3442 granta slota receivera sendera ts cte ctea tcb a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P'3442 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P'3440 rv x rva (tcbFault tcb)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3440 rv x rva (ds_id None)\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>ct. Ex (ccap_relation (cteCap ct)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> isReplyCap (cteCap ct)) slot s \<and> tcb_at' receiver s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s\<rbrace>
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ?P'3442 granta slota receivera sendera ts cte ctea tcb a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P'3442 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P'3440 rv x rva (tcbFault tcb)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3440 rv x rva (ds_id None)\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>r s. cte_wp_at' (\<lambda>cte. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot s \<and> tcb_at' receiver s \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s\<rbrace>
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ?P'3442 granta slota receivera sendera ts cte ctea tcb a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P'3442 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P'3440 rv x rva (tcbFault tcb)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3440 rv x rva (ds_id None)\<rbrace> doIPCTransfer sender None 0 grant receiver \<lbrace>\<lambda>r s. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot s \<and> tcb_at' receiver s \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s\<rbrace>
 2. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ?P'3442 granta slota receivera sendera ts cte ctea tcb a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?P'3442 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?P'3440 rv x rva (tcbFault tcb)
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (3 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault x2. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva); fault = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva fault a x2) (?R''3154 granta slota receivera sendera rv x rva fault x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (IF (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault THEN
  CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr sender,NULL,0,from_bool grant,tcb_ptr_to_ctcb_ptr receiver);;
\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 3. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (3 subgoals):
 1. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3165 rv x rva (Some x2) a x2) (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
CALL cteDeleteOne_'proc(cte_Ptr slot);;
\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 3. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?R3165 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (3 subgoals):
 1. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3570 rv x rva (Some x2) a x2) (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (\<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap));;
(CALL cteDeleteOne_'proc(cte_Ptr slot);;
(\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
(\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)))))
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 3. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?R3570 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R3574 rv x rva (Some x2) a x2) (?Q'3571 rv x rva x2) (SKIP # hs) (do y <- cteDeleteOne slot;
tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (CALL cteDeleteOne_'proc(cte_Ptr slot);;
(\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
(\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI))))
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) (?Q'3571 rv x rva x2)
 3. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); ?R3574 rv x rva (Some x2) s x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> ?R3161 granta slota receivera sendera ts cte ctea tcb a x)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
\<lambda>rv x rva tcb. ?R3574 rv x rva (tcbFault tcb) \<equiv>\<^sup>? ?R3161 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (6 subgoals):
 1. \<And>rv x rva x2 rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3580 rv x rva x2 rvb) (?Q'3580 rv x rva x2 rvb xfdca) (SKIP # hs) (do tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
(\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)))
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 3. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3580 rv x rva x2 rvb (xfdc t)})
 4. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 6. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (8 subgoals):
 1. \<And>rv x rva x2 rvb xfdca. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3618 rv x rva x2 rvb xfdca) (?Q'3618 rv x rva x2 rvb xfdca) (SKIP # hs) (do tag <- getMessageInfo sender;
sendBuffer <- lookupIPCBuffer False sender;
mrs <- getMRs sender sendBuffer tag;
restart <- handleFaultReply x2 receiver (msgLabel tag) mrs;
y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if restart then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (\<acute>restart :== CALL handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr receiver,tcb_ptr_to_ctcb_ptr sender);;
(\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)))
 2. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> ?Q3618 rv x rva x2 rvb xfdc s
 3. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> ?Q'3618 rv x rva x2 rvb xfdc
 4. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 5. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 7. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 8. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva x2 rvb xfdc xa y s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> globals (restart_'_update (\<lambda>_. ret__unsigned_long_' y) s) = globals s
 2. \<And>rv x rva x2 rvb xfdc a s t. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> restart_' (restart_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>)) = ret__unsigned_long_' t
 3. \<And>rv x rva x2 rvb xfdc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> globals (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s)) = globals s
 4. \<And>rv x rva x2 rvb xfdc rv' t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> restart_' rv' t t' (\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)) (?d'3621 rv x rva x2 rvb xfdc rv')
 5. \<And>rv x rva x2 rvb xfdca rvc rv'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3621 rv x rva x2 rvb xfdca rvc) (?Q'3621 rv x rva x2 rvb xfdca rvc rv') (SKIP # hs) (do y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (?d'3621 rv x rva x2 rvb xfdca rv')
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>?Q3621 rv x rva x2 rvb xfdc\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (?Q'3621 rv x rva x2 rvb xfdc)
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (11 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rv' t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> restart_' rv' t t' (\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF \<acute>restart \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)) (?d'3621 rv x rva x2 rvb xfdc rv')
 2. \<And>rv x rva x2 rvb xfdca rvc rv'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3621 rv x rva x2 rvb xfdca rvc) (?Q'3621 rv x rva x2 rvb xfdca rvc rv') (SKIP # hs) (do y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (?d'3621 rv x rva x2 rvb xfdca rv')
 3. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>?Q3621 rv x rva x2 rvb xfdc\<rbrace>
 4. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (?Q'3621 rv x rva x2 rvb xfdc)
 5. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 6. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 7. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 8. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 9. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 10. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
A total of 11 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (10 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3621 rv x rva x2 rvb xfdca rvc) (?Q'3621 rv x rva x2 rvb xfdca rvc rv') (SKIP # hs) (do y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (\<acute>ret__struct_seL4_Fault_C :== CALL seL4_Fault_NullFault_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) \<acute>ret__struct_seL4_Fault_C)));;
IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI))
 2. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>?Q3621 rv x rva x2 rvb xfdc\<rbrace>
 3. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (?Q'3621 rv x rva x2 rvb xfdc)
 4. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 5. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 6. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 7. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 9. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 10. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (10 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3621 rv x rva x2 rvb xfdca rvc) (?G'3809 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C) (SKIP # hs) (do y <- threadSet (tcbFault_update (\<lambda>_. None)) receiver;
if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C)));;
IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)
 2. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>?Q3621 rv x rva x2 rvb xfdc\<rbrace>
 3. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> ?G'3809 rv x rva x2 rvb xfdc rvc rv' v})
 4. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 5. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 6. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 7. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 9. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 10. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ccorres (?r'3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C) (?xf'3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C) (?P3974 rv x rva x2 rvb xfdc rvc) (?G'3809 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C) [] (threadSet (tcbFault_update (\<lambda>_. None)) receiver) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C))))
 2. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C) rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ?r'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C) (?xf'3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C) (?Q'3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C)
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. ?P3974 rv x rva x2 rvb xfdc a and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> ?G'3809 rv x rva x2 rvb xfdc rvc rv' v})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (15 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C s tcb. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3980 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C s tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C))) {s'. (s\<lparr>ksPSpace := (ksPSpace s)(receiver \<mapsto> injectKOS (tcbFault_update (\<lambda>_. None) tcb))\<rparr>, s') \<in> rf_sr}
 2. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; (s, s') \<in> rf_sr; True; ko_at' tcb receiver s; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> ?Q3980 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C s tcb
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 5. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 6. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 8. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 10. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
A total of 15 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; (s, s') \<in> rf_sr; True; ko_at' tcb receiver s; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {sa. sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr receiver \<and> (s\<lparr>ksPSpace := (ksPSpace s)(receiver \<mapsto> injectKOS (tcbFault_update (\<lambda>_. None) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C))) sa) \<in> rf_sr}
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; (s, s') \<in> rf_sr; ko_at' tcb receiver s; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(receiver \<mapsto> KOTCB (tcbFault_update (\<lambda>_. None) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])) ret__struct_seL4_Fault_C))) s') \<in> rf_sr
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (15 subgoals):
 1. \<And>rv x rva ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb receiver s; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> getF (tcbFault_update (\<lambda>_. None) tcb) = getF tcb
 2. \<And>rv x rva ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb receiver s; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. None) tcb) (tcbFault_C_update (\<lambda>_. ret__struct_seL4_Fault_C) tcb')
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 5. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 6. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 8. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 10. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
A total of 15 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva ret__struct_seL4_Fault_C s s' tcb tcb'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb receiver s; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some tcb'; ctcb_relation tcb tcb'\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. None) tcb) (tcbFault_C_update (\<lambda>_. ret__struct_seL4_Fault_C) tcb')
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva ret__struct_seL4_Fault_C s s' tcb tcb' cf'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; ko_at' tcb receiver s; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb'; cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), Some cf'); tcbIPCBuffer tcb = tcbIPCBuffer_C tcb'; carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb'); tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))); UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb'; UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb'; UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb'; tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb'); option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; seL4_Fault_lift (tcbFault_C tcb') = Some cf'; if case cf' of SeL4_Fault_CapFault x \<Rightarrow> True | _ \<Rightarrow> False then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf' \<and> fault_to_H cf' lf' = tcbFault tcb else fault_to_H cf' undefined = tcbFault tcb\<rbrakk> \<Longrightarrow> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), Some SeL4_Fault_NullFault)
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 5. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (13 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a t t'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (?d'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C rv'a)
 3. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 4. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 5. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 7. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 9. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
A total of 13 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (12 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (if rvc then do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od else setThreadState Structures_H.thread_state.Inactive receiver) (IF rv' \<noteq> 0 THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI)
 2. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>?Q3968 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C\<rbrace>
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3968 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C)
 4. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 5. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 6. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 7. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 8. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 9. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 10. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> rvc = (s' \<in> \<lbrace>rv' \<noteq> 0\<rbrace>)
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt4047 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Rt4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4045 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive receiver) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. rvc \<longrightarrow> ?Pt4047 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s) and (\<lambda>s. \<not> rvc \<longrightarrow> ?Pf4045 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s)\<rbrace>
 5. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a)})
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (13 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt4047 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Rt4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (do setThreadState Structures_H.thread_state.Restart receiver;
possibleSwitchTo receiver
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4045 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive receiver) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 3. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. rvc \<longrightarrow> ?Pt4047 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s) and (\<lambda>s. \<not> rvc \<longrightarrow> ?Pf4045 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s)\<rbrace>
 4. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a)})
 5. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 7. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 9. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
A total of 13 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a rvd xfdcb. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a; dc rvd xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4051 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a rvd) (?Q'4051 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a rvd xfdcb) (SKIP # hs) (K_bind (possibleSwitchTo receiver) rvd) (CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))
 2. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R4055 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y\<rbrace> setThreadState Structures_H.thread_state.Restart receiver \<lbrace>?Q4051 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y rv'a\<rbrace>
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4045 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive receiver) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. rvc \<longrightarrow> ((\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4055 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a) s) and (\<lambda>s. \<not> rvc \<longrightarrow> ?Pf4045 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s)\<rbrace>
 5. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rvd. dc rvd (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'4051 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a rvd (xfdc t)}) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a)})
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a rvd xfdcb. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a; dc rvd xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4051 rv x rva x2 rvb xfdca (to_bool rv') rv' ret__struct_seL4_Fault_C y rv'a rvd) (?Q'4051 rv x rva x2 rvb xfdca (to_bool rv') rv' ret__struct_seL4_Fault_C y rv'a rvd xfdcb) (SKIP # hs) (possibleSwitchTo receiver) (CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr receiver))
 2. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R4055 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y\<rbrace> setThreadState Structures_H.thread_state.Restart receiver \<lbrace>?Q4051 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y rv'a\<rbrace>
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4045 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive receiver) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 4. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. rvc \<longrightarrow> ((\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4055 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a) s) and (\<lambda>s. \<not> rvc \<longrightarrow> ?Pf4045 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s)\<rbrace>
 5. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rvd. dc rvd (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'4051 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a rvd (xfdc t)}) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a)})
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 7. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 9. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (13 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R4055 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C y\<rbrace> setThreadState Structures_H.thread_state.Restart receiver \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' receiver and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs'\<rbrace>
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4045 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y) (?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive receiver) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 3. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. rvc \<longrightarrow> ((\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4055 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a) s) and (\<lambda>s. \<not> rvc \<longrightarrow> ?Pf4045 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s)\<rbrace>
 4. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a)})
 5. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 6. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 7. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 8. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 9. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 10. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
A total of 13 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (12 subgoals):
 1. \<And>rv x rva x2 xfdca rvc rv' ret__struct_seL4_Fault_C rv'a. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4045 rv x rva x2 () xfdca (to_bool rv') rv' ret__struct_seL4_Fault_C ()) (?Rf4040 rv x rva x2 () xfdca (to_bool rv') rv' ret__struct_seL4_Fault_C () rv'a) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive receiver) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. rvc \<longrightarrow> ((\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. Invariants_H.valid_queues a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> runnable' Structures_H.thread_state.Restart \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') a)) s) and (\<lambda>s. \<not> rvc \<longrightarrow> ?Pf4045 rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C a s)\<rbrace>
 3. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf4040 rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C y rv'a)})
 4. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 5. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 6. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 7. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 8. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 9. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 10. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (11 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?R3972 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. rvc \<longrightarrow> ((\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. Invariants_H.valid_queues a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> runnable' Structures_H.thread_state.Restart \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') a)) s) and (\<lambda>s. \<not> rvc \<longrightarrow> tcb_at' receiver s \<and> valid_queues' s \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> sch_act_simple s)\<rbrace>
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>})})
 3. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and ?R3972 rv x rva x2 rvb xfdc a\<rbrace>
 4. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 5. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 6. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 7. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 8. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 9. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 10. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
A total of 11 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (11 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> \<lbrace>?P'4161 rv x rva x2 rvb xfdc rvc\<rbrace> threadSet (tcbFault_update (\<lambda>_. None)) receiver \<lbrace>\<lambda>rv s. (rvc \<longrightarrow> ((\<lambda>a. tcb_at' receiver a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. receiver \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. Invariants_H.valid_queues a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread receiver \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> runnable' Structures_H.thread_state.Restart \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') a)) s) \<and> (\<not> rvc \<longrightarrow> tcb_at' receiver s \<and> valid_queues' s \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> sch_act_simple s)\<rbrace>
 2. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>})})
 3. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and (\<lambda>b. True \<and> ?P'4161 rv x rva x2 rvb xfdc a b)\<rbrace>
 4. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 5. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 6. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 7. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 8. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 9. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 10. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
A total of 11 subgoals...
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (10 subgoals):
 1. \<And>rv x rva x2 rvb xfdca rvc rv' ret__struct_seL4_Fault_C. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdca; rvc = to_bool rv'; seL4_Fault_get_tag ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. (s \<in> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> UNIV}}) \<and> (s \<notin> \<lbrace>rv' \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr receiver\<rbrace>})})
 2. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and (\<lambda>b. True \<and> (a \<longrightarrow> obj_at' (\<lambda>obj. if receiver = receiver then True else True) receiver b \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) receiver s \<longrightarrow> receiver \<notin> set (ksReadyQueues s (d, p)))) b \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbFault_update (\<lambda>_. None) tcb) s)) b \<and> sch_act_wf (ksSchedulerAction b) b \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) receiver s \<longrightarrow> receiver \<notin> set (ksReadyQueues s (d, p)))) b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> ksCurDomain b \<le> maxDomain \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbFault_update (\<lambda>_. None) tcb) s)) b) \<and> (\<not> a \<longrightarrow> obj_at' (\<lambda>obj. if receiver = receiver then True else True) receiver b \<and> ((\<forall>ko qdom prio. ko_at' ko receiver b \<and> inQ qdom prio (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ qdom prio ko \<longrightarrow> receiver \<in> set (ksReadyQueues b (qdom, prio))) \<and> valid_queues' b) \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> sch_act_simple b))\<rbrace>
 3. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 4. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 5. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 6. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 7. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 9. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 10. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (9 subgoals):
 1. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>a. tcb_at' receiver and (\<lambda>_. True) and (\<lambda>b. True \<and> (a \<longrightarrow> obj_at' (\<lambda>obj. if receiver = receiver then True else True) receiver b \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) receiver s \<longrightarrow> receiver \<notin> set (ksReadyQueues s (d, p)))) b \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbFault_update (\<lambda>_. None) tcb) s)) b \<and> sch_act_wf (ksSchedulerAction b) b \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) receiver s \<longrightarrow> receiver \<notin> set (ksReadyQueues s (d, p)))) b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> ksCurDomain b \<le> maxDomain \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbFault_update (\<lambda>_. None) tcb) s)) b) \<and> (\<not> a \<longrightarrow> obj_at' (\<lambda>obj. if receiver = receiver then True else True) receiver b \<and> ((\<forall>ko qdom prio. ko_at' ko receiver b \<and> inQ qdom prio (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ qdom prio ko \<longrightarrow> receiver \<in> set (ksReadyQueues b (qdom, prio))) \<and> valid_queues' b) \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> sch_act_simple b))\<rbrace>
 2. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 3. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 4. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 5. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 6. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 8. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 9. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (10 subgoals):
 1. \<And>rv x rva x2 rvb xfdc rvc s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; (Invariants_H.valid_queues and tcb_at' receiver and valid_queues' and valid_objs' and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (tcb_at' receiver and (\<lambda>_. True) and (\<lambda>a. True \<and> (rvc \<longrightarrow> obj_at' (\<lambda>obj. if receiver = receiver then True else True) receiver a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) receiver s \<longrightarrow> receiver \<notin> set (ksReadyQueues s (d, p)))) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbFault_update (\<lambda>_. None) tcb) s)) a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbFault_update (\<lambda>_. None) tcb) \<and> runnable' (tcbState (tcbFault_update (\<lambda>_. None) tcb)))) receiver s \<longrightarrow> receiver \<notin> set (ksReadyQueues s (d, p)))) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbFault_update (\<lambda>_. None) tcb) s)) a) \<and> (\<not> rvc \<longrightarrow> obj_at' (\<lambda>obj. if receiver = receiver then True else True) receiver a \<and> ((\<forall>ko qdom prio. ko_at' ko receiver a \<and> inQ qdom prio (tcbFault_update (\<lambda>_. None) ko) \<and> \<not> inQ qdom prio ko \<longrightarrow> receiver \<in> set (ksReadyQueues a (qdom, prio))) \<and> valid_queues' a) \<and> \<not> runnable' Structures_H.thread_state.Inactive \<and> sch_act_simple a))) s
 2. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>rv. Invariants_H.valid_queues and tcb_at' receiver and valid_queues' and valid_objs' and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 3. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 4. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 5. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 6. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 7. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 9. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 10. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (9 subgoals):
 1. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3621 rv x rva x2 rvb xfdc\<rbrace> do tag <- getMessageInfo sender;
sb <- lookupIPCBuffer False sender;
getMRs sender sb tag >>= handleFaultReply x2 receiver (msgLabel tag)
od \<lbrace>\<lambda>rv. Invariants_H.valid_queues and tcb_at' receiver and valid_queues' and valid_objs' and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 2. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 3. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and ?R3621 rv x rva x2 rvb xfdc) s
 4. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 5. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 6. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 8. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 9. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (8 subgoals):
 1. \<And>rv x rva x2 rvb xfdc. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv = to_bool rv') restart_' (\<lambda>rvc rv'. {s. \<forall>v. seL4_Fault_get_tag v = SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault \<longrightarrow> s\<lparr>ret__struct_seL4_Fault_C_' := v\<rparr> \<in> UNIV})
 2. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) s
 3. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 4. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 5. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 7. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 8. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (7 subgoals):
 1. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) s
 2. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; ?Q3580 rv x rva x2 rvb s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 3. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>?Q3580 rv x rva x2\<rbrace>
 4. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 5. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 6. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 7. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (6 subgoals):
 1. \<And>rv x rva x2 rvb xfdc s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); dc rvb xfdc; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) s; s' \<in> UNIV; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s' \<in> {s. sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s) \<in> UNIV \<inter> \<lbrace>cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>}
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 3. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 6. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (6 subgoals):
 1. \<And>rv x rva x2 s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (s, s') \<in> rf_sr; valid_pspace' s; obj_at' (\<lambda>t. tcbFault t = Some x2) receiver s; tcb_at' sender s; receiver \<noteq> sender; Invariants_H.valid_queues s; tcb_at' receiver s; valid_queues' s; valid_objs' s; sch_act_simple s; ksCurDomain s \<le> maxDomain; sch_act_wf (ksSchedulerAction s) s\<rbrakk> \<Longrightarrow> cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 3. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 6. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (6 subgoals):
 1. \<And>rv x rva x2 s s'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' sender s; receiver \<noteq> sender; Invariants_H.valid_queues s; tcb_at' receiver s; valid_queues' s; valid_objs' s; sch_act_simple s; ksCurDomain s \<le> maxDomain; sch_act_wf (ksSchedulerAction s) s; \<exists>ko. ko_at' ko receiver s \<and> tcbFault ko = Some x2\<rbrakk> \<Longrightarrow> cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 3. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 6. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (6 subgoals):
 1. \<And>rv x rva x2 s s' ko. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' sender s; receiver \<noteq> sender; Invariants_H.valid_queues s; tcb_at' receiver s; valid_queues' s; valid_objs' s; sch_act_simple s; ksCurDomain s \<le> maxDomain; sch_act_wf (ksSchedulerAction s) s; ko_at' ko receiver s; tcbFault ko = Some x2\<rbrakk> \<Longrightarrow> cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 3. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 6. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (6 subgoals):
 1. \<And>rv x rva x2 s s' ko ko'. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); valid_pspace' s; tcb_at' sender s; receiver \<noteq> sender; Invariants_H.valid_queues s; tcb_at' receiver s; valid_queues' s; valid_objs' s; sch_act_simple s; ksCurDomain s \<le> maxDomain; sch_act_wf (ksSchedulerAction s) s; ko_at' ko receiver s; tcbFault ko = Some x2; cslift s' (tcb_ptr_to_ctcb_ptr receiver) = Some ko'; ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> cfault_rel (Some x2) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr receiver\<rightarrow>[''tcbLookupFailure_C'']))))
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 3. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 5. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 6. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>a. valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some x2) receiver and (tcb_at' sender and tcb_at' receiver) and K (receiver \<noteq> sender) and (\<lambda>a. Invariants_H.valid_queues a \<and> tcb_at' receiver a \<and> valid_queues' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)\<rbrace>
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>rv s. valid_pspace' s \<and> obj_at' (\<lambda>t. tcbFault t = Some x2) receiver s \<and> (tcb_at' sender and tcb_at' receiver) s \<and> K (receiver \<noteq> sender) s \<and> Invariants_H.valid_queues s \<and> tcb_at' receiver s \<and> valid_queues' s \<and> valid_objs' s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s\<rbrace>
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (5 subgoals):
 1. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<lbrace>?R3585 rv x rva (Some x2) x2\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>r s. invs' s \<and> obj_at' (\<lambda>t. tcbFault t = Some x2) receiver s \<and> (tcb_at' sender and tcb_at' receiver) s \<and> K (receiver \<noteq> sender) s \<and> Invariants_H.valid_queues s \<and> tcb_at' receiver s \<and> invs' s \<and> valid_objs' s \<and> sch_act_simple s \<and> ksCurDomain s \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction s) s\<rbrace>
 2. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3585 rv x rva (Some x2) x2) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 4. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 5. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and ?R3587 granta slota receivera sendera ts cte ctea tcb x) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}}
flex-flex pairs:
?R3587 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>rv x rva tcb. ?R3585 rv x rva (tcbFault tcb) proof (prove)
goal (4 subgoals):
 1. \<And>rv x rva x2. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) ({s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> \<lbrace>gs_get_assn cteDeleteOne_'proc \<acute>ghost'state = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 2. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some x2) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''3154 (from_bool grant) (cte_Ptr slot) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) rv x rva (Some x2) x2 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 3. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rvb rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>xa. s \<in> {s. fault = Some xa \<longrightarrow> s \<in> ?R''3154 granta slota receivera sendera rv x rva fault xa}}})
 4. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcba. tcbFault tcba = tcbFault tcb) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some x2) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr slot = cte_Ptr slot \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>globals :== ghost'state_'_update (gs_set_assn cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap)) {s'. (s, s') \<in> rf_sr}
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rv rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. fault = Some x \<longrightarrow> s \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True)\<rbrace>}}})
 3. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcba. tcbFault tcba = tcbFault tcb) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>rv x rva x2 s. \<lbrakk>isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer; mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva); capReplyMaster (cteCap rva); (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some x2) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) s\<rbrakk> \<Longrightarrow> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> cte_Ptr slot = cte_Ptr slot \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, globals_update (ghost'state_'_update (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)))) sa) \<in> rf_sr}
 2. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rv rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. fault = Some x \<longrightarrow> s \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True)\<rbrace>}}})
 3. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcba. tcbFault tcba = tcbFault tcb) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>granta slota receivera sendera rv x rva fault. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; isReply rv; mdbPrev (cteMDBNode x) \<noteq> nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer; isReplyCap (cteCap rva) \<and> capReplyMaster (cteCap rva)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some x \<Rightarrow> fault_to_fault_tag x)) ret__unsigned_' (\<lambda>rv rv'. {s. fault_type_'_update (\<lambda>_. case fault of None \<Rightarrow> SCAST(32 signed \<rightarrow> 32) seL4_Fault_NullFault | Some a \<Rightarrow> fault_to_fault_tag a) s \<in> {s. fault = None \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. receivera) (grant_'_update (\<lambda>_. granta) (badge_'_update (\<lambda>_. 0) (endpoint_'_update (\<lambda>_. NULL) (sender_'_update (\<lambda>_. sendera) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>grant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = 0\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr None\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4\<rparr>, fl)) \<and> receivera = receivera \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> receivera = receivera \<and> True))\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. fault = Some x \<longrightarrow> s \<in> \<lbrace>ghost_assertion_data_get cteDeleteOne_'proc (\<lambda>x. snd (snd x)) (ghost_assertion_data_set cteDeleteOne_'proc (UCAST(32 signed \<rightarrow> 32) cap_reply_cap) (\<lambda>x. apsnd (apsnd x)) \<acute>ghost'state) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> slota = slota \<and> (\<forall>t rv. dc rv (xfdc t) \<longrightarrow> True)\<rbrace>}}})
 2. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcba. tcbFault tcba = tcbFault tcb) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>granta slota receivera sendera s s'. \<lbrakk>granta = from_bool grant; slota = cte_Ptr slot; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ts. st_tcb_at' ((=) ts) receiver s \<longrightarrow> isReply ts \<longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> nullPointer \<and> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> (\<forall>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb receiver s \<longrightarrow> ((\<lambda>a. (tcbFault tcb = None \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (receiver \<noteq> sender \<and> None \<noteq> Some 0) and (\<lambda>a. (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot or valid_objs' and Not \<circ> real_cte_at' slot and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) a \<and> tcb_at' receiver a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> (valid_objs' and valid_mdb') a \<and> (invs' and tcb_at' sender and tcb_at' receiver) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_objs' and valid_mdb') a)) a) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> (invs' and cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot and (\<lambda>a. invs' a \<and> obj_at' (\<lambda>tcba. tcbFault tcba = tcbFault tcb) receiver a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> K (receiver \<noteq> sender) a \<and> (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) a \<and> tcb_at' receiver a \<and> invs' a \<and> valid_objs' a \<and> sch_act_simple a \<and> ksCurDomain a \<le> maxDomain \<and> sch_act_wf (ksSchedulerAction a) a)) a)) and (\<lambda>s. \<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) and tcb_at' (ctcb_ptr_to_tcb_ptr receivera)) s)))) \<and> s' \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr receiver) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. isReply ts \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) slota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. mdbPrev (cteMDBNode (cte_to_H cte')) \<noteq> nullPointer \<and> mdbNext (cteMDBNode (cte_to_H cte')) = nullPointer \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbPrev (cteMDBNode (cte_to_H cte')))) = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> {s. isReplyCap (cteCap (cte_to_H cte'a)) \<and> capReplyMaster (cteCap (cte_to_H cte'a)) \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' receivera = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>s s' ts cte ctea tcb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' (Not \<circ> isReply) sender s; sch_act_simple s; ksCurDomain s \<le> maxDomain; real_cte_at' slot s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot s; st_tcb_at' ((=) ts) receiver s; isReply ts; ctes_of s slot = Some cte; mdbPrev (cteMDBNode cte) \<noteq> nullPointer; mdbNext (cteMDBNode cte) = nullPointer; ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea; isReplyCap (cteCap ctea); capReplyMaster (cteCap ctea); ko_at' tcb receiver s\<rbrakk> \<Longrightarrow> (tcbFault tcb = None \<longrightarrow> valid_pspace' s \<and> cur_tcb' s \<and> receiver \<noteq> sender \<and> (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot s \<or> \<not> real_cte_at' slot s) \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_mdb' s) \<and> (\<forall>x. tcbFault tcb = Some x \<longrightarrow> cte_wp_at' (\<lambda>ct. SCAST(32 signed \<rightarrow> 32) cap_reply_cap = - 1 \<or> cteCap ct = capability.NullCap \<or> (\<forall>cap'. ccap_relation (cteCap ct) cap' \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_reply_cap)) slot s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some x) receiver s \<and> receiver \<noteq> sender \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (\<exists>t. ko_at' t receiver s \<and> tcbFault t = tcbFault tcb) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea tcb ko koa obj. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ksCurDomain s \<le> maxDomain; (\<exists>ko. ksPSpace s slot = Some ko \<and> is_aligned slot (objBitsKO ko) \<and> (\<exists>obj. fst (projectKO ko s) = {(obj, s)}) \<and> ps_clear slot (objBitsKO ko) s) \<longrightarrow> isReplyCap (cteCap cte); cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte); isReply (tcbState tcb); ctes_of s slot = Some cte; mdbPrev (cteMDBNode cte) \<noteq> nullPointer; mdbNext (cteMDBNode cte) = nullPointer; ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea; isReplyCap (cteCap ctea); capReplyMaster (cteCap ctea); ksPSpace s sender = Some ko; ksPSpace s receiver = Some koa; is_aligned sender (objBitsKO ko); is_aligned receiver (objBitsKO koa); fst (projectKO ko s) = {(obj, s)}; fst (projectKO koa s) = {(tcb, s)}; \<not> isReply (tcbState obj); ps_clear sender (objBitsKO ko) s; ps_clear receiver (objBitsKO koa) s\<rbrakk> \<Longrightarrow> (tcbFault tcb = None \<longrightarrow> valid_pspace' s \<and> cur_tcb' s \<and> receiver \<noteq> sender \<and> (isReplyCap (cteCap cte) \<or> (\<forall>ko. is_aligned slot (objBitsKO ko) \<longrightarrow> ksPSpace s slot = Some ko \<longrightarrow> (\<forall>obj. fst (projectKO ko s) \<noteq> {(obj, s)}) \<or> \<not> ps_clear slot (objBitsKO ko) s)) \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_mdb' s) \<and> ((\<exists>x. tcbFault tcb = Some x) \<longrightarrow> receiver \<noteq> sender \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> sch_act_wf (ksSchedulerAction s) s) proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres dc xfdc (invs' and st_tcb_at' (Not \<circ> isReply) sender and tcb_at' receiver and sch_act_simple and (\<lambda>s. ksCurDomain s \<le> maxDomain) and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>grant = from_bool grant\<rbrace>) hs (doReplyTransfer sender receiver slot grant) (Call doReplyTransfer_'proc)

goal:
No subgoals!