theory Ipc_AI

lemma si_invs':
  assumes set_endpoint_Q[wp]: "\<And>a b.\<lbrace>Q\<rbrace> set_endpoint a b \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes ext_Q[wp]: "\<And>a b. \<lbrace>Q and valid_objs\<rbrace> do_extended_op (possible_switch_to a) \<lbrace>\<lambda>_. Q\<rbrace>"
  assumes sts_Q[wp]: "\<And>a b. \<lbrace>Q\<rbrace> set_thread_state a b \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes setup_caller_cap_Q[wp]: "\<And>send receive grant. \<lbrace>Q and valid_mdb\<rbrace> setup_caller_cap send receive grant \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes do_ipc_transfer_Q[wp]: "\<And>a b c d e. \<lbrace>Q and valid_objs and valid_mdb\<rbrace> do_ipc_transfer a b c d e \<lbrace>\<lambda>_.Q\<rbrace>"
  notes dxo_wp_weak[wp del]
  shows
  "\<lbrace>invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t\<rbrace>
     send_ipc bl call badge cg cgr t epptr
   \<lbrace>\<lambda>r (s::'state_ext state). invs s \<and> Q s\<rbrace>" apply (simp add: send_ipc_def) apply (rule hoare_seq_ext [OF _ get_simple_ko_sp]) apply (case_tac ep, simp_all) 
    (* ep=IdleEP, bl *)
     apply (cases bl, simp_all)[1] apply (simp add: invs_def valid_state_def valid_pspace_def) apply (wpsimp wp: valid_irq_node_typ valid_ioports_lift) apply (simp add: live_def valid_ep_def) apply (wp valid_irq_node_typ sts_only_idle sts_ep_at_inv[simplified ep_at_def2, simplified]) apply (clarsimp simp: valid_tcb_state_def st_tcb_at_tcb_at)+ apply (rule conjI, clarsimp elim!: obj_at_weakenE simp: is_ep_def) apply (rule conjI, clarsimp simp: st_tcb_at_reply_cap_valid) apply (rule conjI, subgoal_tac "t \<noteq> epptr") apply (drule ko_at_state_refs_ofD active_st_tcb_at_state_refs_ofD)+ apply (erule delta_sym_refs) apply (clarsimp split: if_split_asm) apply (fastforce simp: pred_tcb_at_def2
                       dest!: refs_in_tcb_bound_refs
                       split: if_split_asm) apply (clarsimp simp: pred_tcb_at_def obj_at_def) apply (simp add: obj_at_def is_ep) apply (fastforce dest: idle_no_ex_cap valid_reply_capsD
                     simp: st_tcb_def2) 
     (* ep=IdleEP, \<not>bl *)
     apply wpsimp 
   (* ep=SendEP*)
    apply (rename_tac list) apply (cases bl, simp_all)[1] 
    (* bl *)
     apply (simp add: invs_def valid_state_def valid_pspace_def) apply (wpsimp wp: valid_irq_node_typ valid_ioports_lift) apply (simp add: live_def valid_ep_def) apply (wp hoare_vcg_const_Ball_lift valid_irq_node_typ sts_only_idle
              sts_ep_at_inv[simplified ep_at_def2, simplified]) apply (clarsimp simp: valid_tcb_state_def st_tcb_at_tcb_at) apply (frule ko_at_state_refs_ofD) apply (frule active_st_tcb_at_state_refs_ofD) apply (subgoal_tac "t \<noteq> epptr \<and> t \<notin> set list") apply (erule obj_at_valid_objsE, clarsimp+) apply (clarsimp simp: valid_obj_def valid_ep_def) apply (rule conjI, clarsimp simp: obj_at_def is_ep_def) apply (rule conjI, clarsimp simp: st_tcb_at_reply_cap_valid) apply (rule conjI, erule delta_sym_refs) apply (fastforce split: if_split_asm) apply (fastforce simp: pred_tcb_at_def2
                      dest!: refs_in_tcb_bound_refs
                      split: if_split_asm) apply (simp add: obj_at_def is_ep idle_not_queued) apply (fastforce dest: idle_no_ex_cap valid_reply_capsD
                     simp: st_tcb_def2) apply (rule conjI, clarsimp simp: pred_tcb_at_def obj_at_def) apply (drule(1) sym_refs_ko_atD, clarsimp simp: st_tcb_at_refs_of_rev) apply (drule(1) bspec, clarsimp simp: pred_tcb_at_def obj_at_def) 
   (* \<not>bl *)
    apply wpsimp 
  (* ep = RecvEP *)
   apply (rename_tac list) apply (case_tac list, simp_all add: invs_def valid_state_def valid_pspace_def split del:if_split) apply (rename_tac dest queue) apply (wp valid_irq_node_typ) apply (simp add: if_apply_def2) apply (wp hoare_drop_imps sts_st_tcb_at_cases valid_irq_node_typ do_ipc_transfer_tcb_caps
                    sts_only_idle hoare_vcg_if_lift hoare_vcg_disj_lift thread_get_wp' hoare_vcg_all_lift
               | clarsimp simp:is_cap_simps | wpc
               | strengthen reply_cap_doesnt_exist_strg
                            disjI2_strg[where Q="cte_wp_at (\<lambda>cp. is_master_reply_cap cp \<and> R cp) p s"]
               | (wp hoare_vcg_conj_lift hoare_weak_lift_imp | wp dxo_wp_weak | simp)+
               | wp valid_ioports_lift)+ apply (clarsimp simp: ep_redux_simps conj_ac cong: list.case_cong if_cong) apply (frule(1) sym_refs_ko_atD) apply (clarsimp simp: st_tcb_at_refs_of_rev st_tcb_at_tcb_at ep_at_def2) apply (frule ko_at_state_refs_ofD) apply (frule active_st_tcb_at_state_refs_ofD) apply (erule(1) obj_at_valid_objsE) apply clarsimp apply (subgoal_tac "distinct ([t, dest, epptr, idle_thread s])") apply (clarsimp simp: fun_upd_def[symmetric] fun_upd_idem) apply (clarsimp simp: valid_obj_def valid_ep_def neq_Nil_conv) apply (rule conjI, erule(1) st_tcb_ex_cap) apply clarsimp apply (simp add: obj_at_def is_ep idle_not_queued') apply (subgoal_tac "state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}") apply (subst fun_upd_idem[where x=t], force simp: conj_commute) apply (subgoal_tac "sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound}))") apply (fastforce elim!: pred_tcb_weakenE st_tcb_at_reply_cap_valid simp: conj_commute) apply (erule delta_sym_refs) apply (clarsimp simp: fun_upd_def split: if_split_asm) apply (fastforce simp: fun_upd_def
                    dest!: symreftype_inverse' st_tcb_at_state_refs_ofD refs_in_tcb_bound_refs
                    split: if_split_asm) apply (clarsimp dest!: st_tcb_at_state_refs_ofD simp: sts_refs_of_helper) apply fastforce apply (drule bound_tcb_at_state_refs_ofD) apply (clarsimp simp: tcb_bound_refs_def2) apply (rule conjI, clarsimp dest!: st_tcb_at_state_refs_ofD, (auto simp: set_eq_iff)[1]) apply (rule conjI, clarsimp, (auto simp: set_eq_iff)[1]) apply (rule conjI, clarsimp simp: idle_no_ex_cap idle_not_queued' idle_no_refs) apply (rule conjI, clarsimp dest!: st_tcb_at_tcb_at simp: obj_at_def is_tcb) apply (auto dest!: st_tcb_at_state_refs_ofD simp: idle_no_ex_cap idle_not_queued' idle_no_refs) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t\<rbrace> send_ipc bl call badge cg cgr t epptr \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t\<rbrace> do ep <- get_endpoint epptr;
case ep of IdleEP \<Rightarrow> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [t]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [t])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep. \<lbrace>ko_at (Endpoint ep) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case ep of IdleEP \<Rightarrow> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [t]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [t])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [t]
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [t]
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> do y <- set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP [t])
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> do y <- set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP [t])
od \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (5 subgoals):
 1. bl \<Longrightarrow> \<lbrace>?P'91\<rbrace> set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>rv s. valid_ep (SendEP [t]) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> (live (Endpoint (SendEP [t])) \<longrightarrow> ex_nonz_cap_to epptr s) \<and> zombies_final s \<and> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else state_refs_of s a) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>s. \<lbrakk>bl; (ko_at (Endpoint IdleEP) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_tcb_state (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) and (\<lambda>s. (\<forall>a data. BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> ?P'91 s
 3. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (5 subgoals):
 1. bl \<Longrightarrow> \<lbrace>?P'91\<rbrace> set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>rv s. tcb_at t s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> ex_nonz_cap_to epptr s \<and> zombies_final s \<and> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else state_refs_of s a) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>s. \<lbrakk>bl; (ko_at (Endpoint IdleEP) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_tcb_state (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) and (\<lambda>s. (\<forall>a data. BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> ?P'91 s
 3. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; (ko_at (Endpoint IdleEP) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_tcb_state (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) and (\<lambda>s. (\<forall>a data. BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> tcb_at t s \<and> pspace_aligned s \<and> pspace_distinct s \<and> ((\<not> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<longrightarrow> ex_nonz_cap_to t s) \<and> if_live_then_nonz_cap s) \<and> ex_nonz_cap_to epptr s \<and> zombies_final s \<and> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else ((state_refs_of s)(t := tcb_st_refs_of (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<union> {r \<in> state_refs_of s t. snd r = TCBBound})) a) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> (valid_idle and (\<lambda>s. t = idle_thread s \<longrightarrow> idle (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>))) s \<and> (only_idle and (\<lambda>s. idle (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<longrightarrow> t = idle_thread s)) s \<and> if_unsafe_then_cap s \<and> (valid_reply_caps s \<and> (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> \<noteq> BlockedOnReply \<longrightarrow> \<not> has_reply_cap t s)) \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> ep_at epptr s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; t \<noteq> epptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a)
 2. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr
 3. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; t \<noteq> epptr; state_refs_of s epptr = refs_of (Endpoint IdleEP); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = epptr then {(t, EPSend)} else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a)
 2. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr
 3. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s x y tp. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; t \<noteq> epptr; state_refs_of s epptr = refs_of (Endpoint IdleEP); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; (y, tp) \<in> (if x = epptr then {(t, EPSend)} else if x = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x); (y, tp) \<notin> state_refs_of s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = epptr then {(t, EPSend)} else if y = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>s x y tp. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; t \<noteq> epptr; state_refs_of s epptr = refs_of (Endpoint IdleEP); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = epptr then {(t, EPSend)} else if x = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = epptr then {(t, EPSend)} else if y = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 3. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr
 4. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 5. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 7. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s x y tp. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; t \<noteq> epptr; state_refs_of s epptr = refs_of (Endpoint IdleEP); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = epptr then {(t, EPSend)} else if x = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = epptr then {(t, EPSend)} else if y = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr
 3. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr
 2. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; ko_at (Endpoint IdleEP) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; kheap s epptr = Some (Endpoint IdleEP); valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<not> bl \<Longrightarrow> \<lbrace>ko_at (Endpoint IdleEP) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep x2. ep = SendEP x2 \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep list. ep = SendEP list \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case bl of True \<Rightarrow> do set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (list @ [t])
od | False \<Rightarrow> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep list. \<lbrakk>ep = SendEP list; bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> do y <- set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP (list @ [t]))
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep list. \<lbrakk>ep = SendEP list; bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> do y <- set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP (list @ [t]))
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep list. \<lbrakk>ep = SendEP list; bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> do y <- set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP (list @ [t]))
od \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list. bl \<Longrightarrow> \<lbrace>?P'536 (SendEP list) list\<rbrace> set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>rv s. valid_ep (SendEP (list @ [t])) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> (live (Endpoint (SendEP (list @ [t]))) \<longrightarrow> ex_nonz_cap_to epptr s) \<and> zombies_final s \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else state_refs_of s a) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep list s. \<lbrakk>ep = SendEP list; bl; (ko_at (Endpoint (SendEP list)) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_tcb_state (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) and (\<lambda>s. (\<forall>a data. BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> ?P'536 ep list s
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list. bl \<Longrightarrow> \<lbrace>?P'536 (SendEP list) list\<rbrace> set_thread_state t (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>rv s. tcb_at t s \<and> (\<forall>t\<in>set list. tcb_at t s) \<and> distinct list \<and> t \<notin> set list \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> ex_nonz_cap_to epptr s \<and> zombies_final s \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else state_refs_of s a) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep list s. \<lbrakk>ep = SendEP list; bl; (ko_at (Endpoint (SendEP list)) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_tcb_state (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) and (\<lambda>s. (\<forall>a data. BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> ?P'536 ep list s
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep list s. \<lbrakk>ep = SendEP list; bl; (ko_at (Endpoint (SendEP list)) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> (valid_objs and valid_tcb_state (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) and (\<lambda>s. (\<forall>a data. BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> tcb_at t s \<and> (\<forall>x\<in>set list. tcb_at x s) \<and> distinct list \<and> t \<notin> set list \<and> pspace_aligned s \<and> pspace_distinct s \<and> ((\<not> halted (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<longrightarrow> ex_nonz_cap_to t s) \<and> if_live_then_nonz_cap s) \<and> ex_nonz_cap_to epptr s \<and> zombies_final s \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else ((state_refs_of s)(t := tcb_st_refs_of (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<union> {r \<in> state_refs_of s t. snd r = TCBBound})) a) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> (valid_idle and (\<lambda>s. t = idle_thread s \<longrightarrow> idle (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>))) s \<and> (only_idle and (\<lambda>s. idle (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<longrightarrow> t = idle_thread s)) s \<and> if_unsafe_then_cap s \<and> (valid_reply_caps s \<and> (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr> \<noteq> BlockedOnReply \<longrightarrow> \<not> has_reply_cap t s)) \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> ep_at epptr s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> (\<forall>x\<in>set list. tcb_at x s) \<and> distinct list \<and> t \<notin> set list \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list))\<rbrakk> \<Longrightarrow> ep_at epptr s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> (\<forall>x\<in>set list. tcb_at x s) \<and> distinct list \<and> t \<notin> set list \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> ep_at epptr s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> (\<forall>x\<in>set list. tcb_at x s) \<and> distinct list \<and> t \<notin> set list \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; t \<noteq> epptr \<and> t \<notin> set list\<rbrakk> \<Longrightarrow> ep_at epptr s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> (\<forall>x\<in>set list. tcb_at x s) \<and> distinct list \<and> t \<notin> set list \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); valid_obj epptr (Endpoint (SendEP list)) s; t \<noteq> epptr; t \<notin> set list\<rbrakk> \<Longrightarrow> ep_at epptr s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> (\<forall>x\<in>set list. tcb_at x s) \<and> distinct list \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list\<rbrakk> \<Longrightarrow> ep_at epptr s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list\<rbrakk> \<Longrightarrow> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if a = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>list s x y tp. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; (y, tp) \<in> (if x = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if x = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x); (y, tp) \<notin> state_refs_of s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if y = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>list s x y tp. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if x = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if y = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 3. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 5. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>list s x y tp. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if x = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = epptr then insert (t, EPSend) (set list \<times> {EPSend}) else if y = t then insert (epptr, TCBBlockedSend) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 4. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. tcb_at t s; distinct list\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = set list \<times> {EPSend}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (SendEP list)); t \<noteq> epptr; t \<notin> set list; list \<noteq> []; \<forall>t\<in>set list. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; distinct list\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 3. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<notin> set list
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>list s. \<lbrakk>bl; ko_at (Endpoint (SendEP list)) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (SendEP list)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> t \<notin> set list
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>list s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; state_refs_of s epptr = set list \<times> {EPSend}; \<forall>x\<in>set list. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s; t \<in> set list\<rbrakk> \<Longrightarrow> False
 2. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep list. \<lbrakk>ep = SendEP list; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> return () \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep x3. ep = RecvEP x3 \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep list. ep = RecvEP list \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP list)) epptr and (invs and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep list a lista. \<lbrakk>ep = RecvEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP (a # lista))) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> do y <- set_endpoint epptr (case lista of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP lista);
recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Running;
y <- do_extended_op (possible_switch_to a);
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Inactive)
od \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep list dest queue. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP (dest # queue))) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)\<rbrace> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- do_extended_op (possible_switch_to dest);
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Inactive)
od \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>ep list dest queue y recv_state reply_can_grant ya yb. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue; call; \<not> (cg \<or> cgr)\<rbrakk> \<Longrightarrow> \<lbrace>?P'1866 ep list dest queue y recv_state reply_can_grant ya yb\<rbrace> set_thread_state t Inactive \<lbrace>\<lambda>rv s. only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep list dest queue y recv_state reply_can_grant ya. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1769 ep list dest queue y recv_state reply_can_grant ya\<rbrace> do_extended_op (possible_switch_to dest) \<lbrace>\<lambda>yb. if call then \<lambda>s. (cg \<or> cgr \<longrightarrow> (valid_objs and pspace_aligned and st_tcb_at (Not \<circ> halted) t and st_tcb_at active dest and K (t \<noteq> dest)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (if_live_then_nonz_cap and st_tcb_at (Not \<circ> halted) t) s \<and> zombies_final s \<and> sym_refs ((state_refs_of s)(t := {r \<in> state_refs_of s t. snd r = TCBBound})) \<and> sym_refs (state_hyp_refs_of s) \<and> (valid_mdb and valid_objs and pspace_aligned and st_tcb_at (Not \<circ> halted) t and K (t \<noteq> dest)) s \<and> valid_ioc s \<and> (valid_idle and (\<lambda>s. t \<noteq> idle_thread s \<and> dest \<noteq> idle_thread s)) s \<and> only_idle s \<and> (if_unsafe_then_cap and valid_objs and tcb_at dest and ex_nonz_cap_to dest) s \<and> (valid_reply_caps and pspace_aligned and st_tcb_at (Not \<circ> awaiting_reply) t and tcb_at dest) s \<and> (valid_reply_masters and tcb_at dest) s \<and> (valid_objs and valid_global_refs and st_tcb_at (Not \<circ> halted) t) s \<and> valid_arch_state s \<and> valid_irq_node s \<and> (valid_irq_handlers and tcb_at t) s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> (valid_arch_caps and valid_objs and st_tcb_at (Not \<circ> halted) t) s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> (valid_objs and cap_refs_in_kernel_window and st_tcb_at (Not \<circ> halted) t) s \<and> pspace_respects_device_region s \<and> (cap_refs_respects_device_region and valid_objs) s \<and> cur_tcb s \<and> (Q and valid_mdb) s) \<and> (\<not> (cg \<or> cgr) \<longrightarrow> (valid_objs and valid_tcb_state Inactive and (\<lambda>s. (\<forall>a data. Inactive = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted Inactive \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> ((\<not> halted Inactive \<longrightarrow> ex_nonz_cap_to t s) \<and> if_live_then_nonz_cap s) \<and> zombies_final s \<and> sym_refs ((state_refs_of s)(t := tcb_st_refs_of Inactive \<union> {r \<in> state_refs_of s t. snd r = TCBBound})) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> (valid_idle and (\<lambda>s. t = idle_thread s \<longrightarrow> idle Inactive)) s \<and> ?P'1866 ep list dest queue y recv_state reply_can_grant ya yb s) else (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s)\<rbrace>
 3. \<And>ep list dest queue y recv_state reply_can_grant. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1768 ep list dest queue y recv_state reply_can_grant\<rbrace> set_thread_state dest Running \<lbrace>?B1769 ep list dest queue y recv_state reply_can_grant\<rbrace>
 4. \<And>ep list dest queue y recv_state. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1767 ep list dest queue y recv_state\<rbrace> case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail \<lbrace>?B1768 ep list dest queue y recv_state\<rbrace>
 5. \<And>ep list dest queue y. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1766 ep list dest queue y\<rbrace> get_thread_state dest \<lbrace>?B1767 ep list dest queue y\<rbrace>
 6. \<And>ep list dest queue. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?Q1765 ep list dest queue\<rbrace> set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) \<lbrace>?B1766 ep list dest queue\<rbrace>
 7. \<And>ep list dest queue s. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue; (ko_at (Endpoint (RecvEP (dest # queue))) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> ?Q1765 ep list dest queue s proof (prove)
goal (7 subgoals):
 1. \<And>ep list dest queue recv_state reply_can_grant. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue; call; \<not> cg \<and> \<not> cgr\<rbrakk> \<Longrightarrow> \<lbrace>?P'1866 (RecvEP (dest # queue)) (dest # queue) dest queue () recv_state reply_can_grant () ()\<rbrace> set_thread_state t Inactive \<lbrace>\<lambda>rv s. only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep list dest queue y recv_state reply_can_grant ya. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1769 ep list dest queue y recv_state reply_can_grant ya\<rbrace> do_extended_op (possible_switch_to dest) \<lbrace>\<lambda>yb. if call then \<lambda>s. (cg \<or> cgr \<longrightarrow> (valid_objs and pspace_aligned and st_tcb_at (Not \<circ> halted) t and st_tcb_at active dest and K (t \<noteq> dest)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (if_live_then_nonz_cap and st_tcb_at (Not \<circ> halted) t) s \<and> zombies_final s \<and> sym_refs ((state_refs_of s)(t := {r \<in> state_refs_of s t. snd r = TCBBound})) \<and> sym_refs (state_hyp_refs_of s) \<and> (valid_mdb and valid_objs and pspace_aligned and st_tcb_at (Not \<circ> halted) t and K (t \<noteq> dest)) s \<and> valid_ioc s \<and> (valid_idle and (\<lambda>s. t \<noteq> idle_thread s \<and> dest \<noteq> idle_thread s)) s \<and> only_idle s \<and> (if_unsafe_then_cap and valid_objs and tcb_at dest and ex_nonz_cap_to dest) s \<and> (valid_reply_caps and pspace_aligned and st_tcb_at (Not \<circ> awaiting_reply) t and tcb_at dest) s \<and> (valid_reply_masters and tcb_at dest) s \<and> (valid_objs and valid_global_refs and st_tcb_at (Not \<circ> halted) t) s \<and> valid_arch_state s \<and> valid_irq_node s \<and> (valid_irq_handlers and tcb_at t) s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> (valid_arch_caps and valid_objs and st_tcb_at (Not \<circ> halted) t) s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> (valid_objs and cap_refs_in_kernel_window and st_tcb_at (Not \<circ> halted) t) s \<and> pspace_respects_device_region s \<and> (cap_refs_respects_device_region and valid_objs) s \<and> cur_tcb s \<and> (Q and valid_mdb) s) \<and> (\<not> (cg \<or> cgr) \<longrightarrow> (valid_objs and valid_tcb_state Inactive and (\<lambda>s. (\<forall>a data. Inactive = BlockedOnReceive a data \<longrightarrow> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> halted Inactive \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s))) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> ((\<not> halted Inactive \<longrightarrow> ex_nonz_cap_to t s) \<and> if_live_then_nonz_cap s) \<and> zombies_final s \<and> sym_refs ((state_refs_of s)(t := tcb_st_refs_of Inactive \<union> {r \<in> state_refs_of s t. snd r = TCBBound})) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> (valid_idle and (\<lambda>s. t = idle_thread s \<longrightarrow> idle Inactive)) s \<and> ?P'1866 ep list dest queue y recv_state reply_can_grant ya yb s) else (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s)\<rbrace>
 3. \<And>ep list dest queue y recv_state reply_can_grant. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1768 ep list dest queue y recv_state reply_can_grant\<rbrace> set_thread_state dest Running \<lbrace>?B1769 ep list dest queue y recv_state reply_can_grant\<rbrace>
 4. \<And>ep list dest queue y recv_state. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1767 ep list dest queue y recv_state\<rbrace> case recv_state of BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some epptr) badge cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail \<lbrace>?B1768 ep list dest queue y recv_state\<rbrace>
 5. \<And>ep list dest queue y. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?B1766 ep list dest queue y\<rbrace> get_thread_state dest \<lbrace>?B1767 ep list dest queue y\<rbrace>
 6. \<And>ep list dest queue. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue\<rbrakk> \<Longrightarrow> \<lbrace>?Q1765 ep list dest queue\<rbrace> set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) \<lbrace>?B1766 ep list dest queue\<rbrace>
 7. \<And>ep list dest queue s. \<lbrakk>ep = RecvEP (dest # queue); list = dest # queue; (ko_at (Endpoint (RecvEP (dest # queue))) epptr and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to epptr and ex_nonz_cap_to t)) s\<rbrakk> \<Longrightarrow> ?Q1765 ep list dest queue s proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>ko_at (Endpoint (RecvEP (dest # queue))) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> state_refs_of s t. snd r = TCBBound} else if a = epptr then {r \<in> ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue). snd r = TCBBound} else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> tcb_at epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> tcb_at epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> state_refs_of s t. snd r = TCBBound} else if a = epptr then {r \<in> ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue). snd r = TCBBound} else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = epptr then {r \<in> ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue). snd r = TCBBound} else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> epptr \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = epptr) (epptr, tcb_cnode_index 2) s \<and> tcb_at epptr s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> ex_nonz_cap_to dest s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = epptr then {r \<in> ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue). snd r = TCBBound} else if a = dest then {r \<in> state_refs_of s dest. snd r = TCBBound} else if a = epptr then ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> dest \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> tcb_at dest s \<and> ex_nonz_cap_to dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> tcb_at dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> tcb_at epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> ex_nonz_cap_to dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = epptr then {r \<in> ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue). snd r = TCBBound} else if a = dest then {r \<in> state_refs_of s dest. snd r = TCBBound} else if a = epptr then ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> ex_nonz_cap_to dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = dest then {r \<in> state_refs_of s dest. snd r = TCBBound} else if a = epptr then ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> dest \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at epptr s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s)) \<and> (t \<noteq> epptr \<longrightarrow> t \<noteq> dest \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> ex_nonz_cap_to dest s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> state_refs_of s t. snd r = TCBBound} else if a = dest then {r \<in> state_refs_of s dest. snd r = TCBBound} else if a = epptr then ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> dest \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> tcb_at dest s \<and> ex_nonz_cap_to dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> tcb_at dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> ex_nonz_cap_to dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> state_refs_of s t. snd r = TCBBound} else if a = dest then {r \<in> state_refs_of s dest. snd r = TCBBound} else if a = epptr then ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s) \<and> ex_nonz_cap_to dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> sym_refs (\<lambda>a. if a = dest then {r \<in> state_refs_of s dest. snd r = TCBBound} else if a = epptr then ep_q_refs_of (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) else state_refs_of s a) \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> dest \<noteq> idle_thread s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> tcb_at t s \<and> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> valid_ep (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue) s \<and> cte_wp_at (\<lambda>a. (\<exists>x R. a = ReplyCap x True R) \<and> obj_ref_of a = dest) (dest, tcb_cnode_index 2) s \<and> tcb_at dest s))) proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>ko_at (Endpoint (RecvEP (dest # queue))) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> tcb_at t s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> tcb_at dest s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> tcb_at dest s \<and> tcb_at t s \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> tcb_at dest s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s))) proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>ko_at (Endpoint (RecvEP (dest # queue))) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = refs_of (Endpoint (RecvEP (dest # queue))) \<and> (\<forall>(x, tp)\<in>refs_of (Endpoint (RecvEP (dest # queue))). obj_at (\<lambda>ko. (epptr, symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> tcb_at t s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> tcb_at dest s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> tcb_at dest s \<and> tcb_at t s \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> tcb_at dest s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s))) proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>ko_at (Endpoint (RecvEP (dest # queue))) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s))) proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>ko_at (Endpoint (RecvEP (dest # queue))) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = refs_of (Endpoint (RecvEP (dest # queue)))\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s))) proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>ko_at (Endpoint (RecvEP (dest # queue))) epptr s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = refs_of (Endpoint (RecvEP (dest # queue))); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s))) proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s ko. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = refs_of (Endpoint (RecvEP (dest # queue))); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some ko; Endpoint (RecvEP (dest # queue)) = ko; valid_obj epptr ko s\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s))) proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s))) proof (prove)
goal (2 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; distinct [t, dest, epptr, idle_thread s]\<rbrakk> \<Longrightarrow> (dest = epptr \<longrightarrow> t \<noteq> epptr \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> tcb_at epptr s \<and> epptr \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<or> distinct queue \<and> tcb_at epptr s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = epptr \<and> (\<exists>x R. a = ReplyCap x True R)) (epptr, tcb_cnode_index 2) s))) \<and> (dest \<noteq> epptr \<longrightarrow> (t = epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> tcb_at epptr s \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) epptr s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) epptr s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = epptr then {r. snd r = TCBBound \<and> r \<in> set queue \<times> {EPRecv}} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)) \<and> (t \<noteq> epptr \<longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> t \<noteq> dest \<and> dest \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs (\<lambda>a. if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> sym_refs (\<lambda>a. if a = t then {r. snd r = TCBBound \<and> r \<in> state_refs_of s t} else if a = dest then {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest} else if a = epptr then set queue \<times> {EPRecv} else state_refs_of s a) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)))
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (2 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s\<rbrakk> \<Longrightarrow> distinct queue \<and> ex_nonz_cap_to dest s \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest}, t := {r. snd r = TCBBound \<and> r \<in> state_refs_of s t})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> distinct queue \<and> (\<forall>t\<in>set queue. tcb_at t s) \<and> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (2 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; tcb_at dest s; \<forall>t\<in>set queue. tcb_at t s; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> ex_nonz_cap_to dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest}, t := {r. snd r = TCBBound \<and> r \<in> state_refs_of s t})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (3 subgoals):
 1. \<And>dest queue s st. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; tcb_at dest s; \<forall>t\<in>set queue. tcb_at t s; dest \<notin> set queue; distinct queue; \<exists>pl. st = BlockedOnReceive epptr pl\<rbrakk> \<Longrightarrow> \<not> halted st
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; tcb_at dest s; \<forall>t\<in>set queue. tcb_at t s; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest}, t := {r. snd r = TCBBound \<and> r \<in> state_refs_of s t})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 3. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (2 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; tcb_at dest s; \<forall>t\<in>set queue. tcb_at t s; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) epptr s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest}, t := {r. snd r = TCBBound \<and> r \<in> state_refs_of s t})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (2 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest}, t := {r. snd r = TCBBound \<and> r \<in> state_refs_of s t})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (3 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest}, t := {r. snd r = TCBBound \<and> r \<in> state_refs_of s t})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}
 3. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (3 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}
 3. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (4 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}; sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound}))\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) dest s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) t s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r. snd r = TCBBound \<and> r \<in> state_refs_of s dest})) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) dest s \<or> cte_wp_at (\<lambda>a. obj_ref_of a = dest \<and> (\<exists>x R. a = ReplyCap x True R)) (dest, tcb_cnode_index 2) s)
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound}))
 3. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}
 4. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (3 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound}))
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}
 3. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (4 subgoals):
 1. \<And>dest queue s x y tp. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}; (y, tp) \<in> ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound})) x; (y, tp) \<notin> state_refs_of s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound})) y
 2. \<And>dest queue s x y tp. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound})) x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound})) y
 3. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}
 4. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (3 subgoals):
 1. \<And>dest queue s x y tp. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound})) x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> ((state_refs_of s)(epptr := set queue \<times> {EPRecv}, dest := {r \<in> state_refs_of s dest. snd r = TCBBound})) y
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}
 3. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (2 subgoals):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<exists>ko. kheap s dest = Some ko \<and> is_tcb ko; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue\<rbrakk> \<Longrightarrow> state_refs_of s t = {r \<in> state_refs_of s t. snd r = TCBBound}
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (2 subgoals):
 1. \<And>dest queue s ko ts ntfnptr ntfnptra. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); t \<noteq> dest; t \<noteq> epptr; t \<noteq> idle_thread s; dest \<noteq> epptr; dest \<noteq> idle_thread s; epptr \<noteq> idle_thread s; \<forall>t\<in>set queue. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; dest \<notin> set queue; distinct queue; kheap s dest = Some ko; is_tcb ko; active ts; obj_at (tcb_ntfn_is_bound ntfnptr) t s; state_refs_of s t = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr; obj_at (tcb_ntfn_is_bound ntfnptra) dest s; state_refs_of s dest = insert (epptr, TCBBlockedRecv) (tcb_bound_refs ntfnptra)\<rbrakk> \<Longrightarrow> tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr = tcb_bound_refs ntfnptr
 2. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; \<exists>ts ntfnptr. tcb_bound_refs ntfnptr = state_refs_of s t \<and> obj_at (tcb_ntfn_is_bound ntfnptr) t s \<and> state_refs_of s t = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> distinct [t, dest, epptr, idle_thread s] proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s ts ntfnptr. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of ts \<union> set_option ntfnptr \<times> {TCBBound}; obj_at (tcb_ntfn_is_bound ntfnptr) t s; state_refs_of s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> dest \<and> t \<noteq> epptr \<and> t \<noteq> idle_thread s \<and> dest \<noteq> epptr \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s ts ntfnptr. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of ts \<union> set_option ntfnptr \<times> {TCBBound}; obj_at (tcb_ntfn_is_bound ntfnptr) t s; state_refs_of s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> epptr \<and> t \<noteq> idle_thread s \<and> dest \<noteq> epptr \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s ts ntfnptr. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of ts \<union> set_option ntfnptr \<times> {TCBBound}; obj_at (tcb_ntfn_is_bound ntfnptr) t s; state_refs_of s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s \<and> dest \<noteq> epptr \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s ts ntfnptr. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of ts \<union> set_option ntfnptr \<times> {TCBBound}; obj_at (tcb_ntfn_is_bound ntfnptr) t s; state_refs_of s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> dest \<noteq> epptr \<and> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s proof (prove)
goal (1 subgoal):
 1. \<And>dest queue s ts ntfnptr. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to epptr s; ex_nonz_cap_to t s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) dest s; \<forall>x\<in>set queue. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnReceive epptr pl) x s; state_refs_of s epptr = insert (dest, EPRecv) (set queue \<times> {EPRecv}); kheap s epptr = Some (Endpoint (RecvEP (dest # queue))); valid_obj epptr (Endpoint (RecvEP (dest # queue))) s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of ts \<union> set_option ntfnptr \<times> {TCBBound}; obj_at (tcb_ntfn_is_bound ntfnptr) t s; state_refs_of s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> dest \<noteq> idle_thread s \<and> epptr \<noteq> idle_thread s proof (prove)
goal:
No subgoals!