theory Ipc_AI

lemma ri_invs':
  fixes Q t cap is_blocking
  notes if_split[split del]
  notes hyp_refs_of_simps[simp del]
  assumes set_endpoint_Q[wp]: "\<And>a b.\<lbrace>Q\<rbrace> set_endpoint a b \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes set_notification_Q[wp]: "\<And>a b.\<lbrace>Q\<rbrace> complete_signal a b \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes sts_Q[wp]: "\<And>a b. \<lbrace>Q\<rbrace> set_thread_state a b \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes ext_Q[wp]: "\<And>a (s::'a::state_ext state). \<lbrace>Q and valid_objs\<rbrace> do_extended_op (possible_switch_to a) \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes scc_Q[wp]: "\<And>a b c. \<lbrace>valid_mdb and Q\<rbrace> setup_caller_cap a b c \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes dit_Q[wp]: "\<And>a b c d e. \<lbrace>valid_mdb and valid_objs and Q\<rbrace> do_ipc_transfer a b c d e \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes failed_transfer_Q[wp]: "\<And>a. \<lbrace>Q\<rbrace> do_nbrecv_failed_transfer a \<lbrace>\<lambda>_. Q\<rbrace>"
  notes dxo_wp_weak[wp del]
  shows
  "\<lbrace>(invs::'state_ext state \<Rightarrow> bool) and Q and st_tcb_at active t and ex_nonz_cap_to t
         and cte_wp_at ((=) cap.NullCap) (t, tcb_cnode_index 3)
         and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s)\<rbrace>
     receive_ipc t cap is_blocking \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>" (is "\<lbrace>?pre\<rbrace> _ \<lbrace>_\<rbrace>") apply (simp add: receive_ipc_def split_def) apply (cases cap, simp_all) apply (rename_tac ep badge rights) apply (rule hoare_seq_ext[OF _ get_simple_ko_sp]) apply (rule hoare_seq_ext[OF _ gbn_sp]) apply (rule hoare_seq_ext) 
  (* set up precondition for old proof *)
    apply (rule_tac R="ko_at (Endpoint x) ep and ?pre" in hoare_vcg_if_split) apply (wp complete_signal_invs) apply (case_tac x) apply (wp | rule hoare_pre, wpc | simp)+ apply (simp add: invs_def valid_state_def valid_pspace_def) apply (rule hoare_pre, wp valid_irq_node_typ valid_ioports_lift) apply (simp add: valid_ep_def) apply (wp valid_irq_node_typ sts_only_idle sts_ep_at_inv[simplified ep_at_def2, simplified]
                    failed_transfer_Q[simplified do_nbrecv_failed_transfer_def, simplified]
                 | simp add: live_def do_nbrecv_failed_transfer_def)+ apply (clarsimp simp: st_tcb_at_tcb_at valid_tcb_state_def invs_def valid_state_def valid_pspace_def) apply (rule conjI, clarsimp elim!: obj_at_weakenE simp: is_ep_def) apply (rule conjI, clarsimp simp: st_tcb_at_reply_cap_valid) apply (rule conjI) apply (subgoal_tac "ep \<noteq> t") apply (drule obj_at_state_refs_ofD) apply (drule active_st_tcb_at_state_refs_ofD) apply (erule delta_sym_refs) apply (clarsimp split: if_split_asm) apply (clarsimp split: if_split_asm if_split) apply (fastforce dest!: symreftype_inverse'
                         simp: pred_tcb_at_def2 tcb_bound_refs_def2) apply (clarsimp simp: obj_at_def st_tcb_at_def) apply (simp add: obj_at_def is_ep_def) apply (fastforce dest!: idle_no_ex_cap valid_reply_capsD
                      simp: st_tcb_def2) apply (simp add: invs_def valid_state_def valid_pspace_def) apply (wp hoare_drop_imps valid_irq_node_typ hoare_post_imp[OF disjI1]
              sts_only_idle
         | simp add: valid_tcb_state_def cap_range_def
         | strengthen reply_cap_doesnt_exist_strg | wpc
         | (wp hoare_vcg_conj_lift | wp dxo_wp_weak | simp)+
         | wp valid_ioports_lift)+ apply (clarsimp simp: st_tcb_at_tcb_at neq_Nil_conv) apply (frule(1) sym_refs_obj_atD) apply (frule(1) hyp_sym_refs_obj_atD) apply (frule ko_at_state_refs_ofD) apply (frule ko_at_state_hyp_refs_ofD) apply (erule(1) obj_at_valid_objsE) apply (clarsimp simp: st_tcb_at_refs_of_rev st_tcb_at_tcb_at
                          valid_obj_def ep_redux_simps
                    cong: list.case_cong if_cong) apply (frule(1) st_tcb_ex_cap[where P="\<lambda>ts. \<exists>pl. ts = st pl" for st],
           clarsimp+) apply (clarsimp simp: valid_ep_def) apply (frule active_st_tcb_at_state_refs_ofD) apply (frule st_tcb_at_state_refs_ofD
                 [where P="\<lambda>ts. \<exists>pl. ts = st pl" for st]) apply (subgoal_tac "y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and>
                        idle_thread s \<notin> set ys") apply (clarsimp simp: st_tcb_def2 is_ep_def
       conj_comms tcb_at_cte_at_2) apply (clarsimp simp: obj_at_def) apply (erule delta_sym_refs) apply (clarsimp split: if_split_asm) apply (clarsimp split: if_split_asm if_split)  (* FIXME *)
        apply ((fastforce simp: pred_tcb_at_def2 tcb_bound_refs_def2 is_tcb
                       dest!: symreftype_inverse')+)[3] apply (rule conjI) apply (clarsimp simp: pred_tcb_at_def2 tcb_bound_refs_def2
                     split: if_split_asm) apply (simp add: set_eq_subset) apply (rule conjI, clarsimp dest!: idle_no_ex_cap)+ apply (simp add: idle_not_queued') apply (simp add: invs_def valid_state_def valid_pspace_def) apply (rule hoare_pre) apply (wp hoare_vcg_const_Ball_lift valid_irq_node_typ sts_only_idle
              sts_ep_at_inv[simplified ep_at_def2, simplified] valid_ioports_lift
              failed_transfer_Q[unfolded do_nbrecv_failed_transfer_def, simplified]
              | simp add: live_def valid_ep_def do_nbrecv_failed_transfer_def
              | wpc)+ apply (clarsimp simp: valid_tcb_state_def st_tcb_at_tcb_at) apply (rule conjI, clarsimp elim!: obj_at_weakenE simp: is_ep_def) apply (rule conjI, fastforce simp: st_tcb_def2) apply (frule ko_at_state_refs_ofD) apply (frule active_st_tcb_at_state_refs_ofD) apply (frule(1) sym_refs_ko_atD) apply (rule obj_at_valid_objsE, assumption+) apply (clarsimp simp: valid_obj_def valid_ep_def) apply (rule context_conjI) apply (rule notI, (drule(1) bspec)+, (drule obj_at_state_refs_ofD)+, clarsimp) apply (clarsimp simp: pred_tcb_at_def2 tcb_bound_refs_def2) apply (blast intro: reftype.simps) apply (rule conjI, erule delta_sym_refs) apply (clarsimp split: if_split_asm if_split) apply (rule conjI, rule impI) apply (clarsimp simp: pred_tcb_at_def2 obj_at_def) apply (fastforce simp: pred_tcb_at_def2 tcb_bound_refs_def2
                     dest!: symreftype_inverse') apply (clarsimp split: if_split_asm if_split) apply (fastforce simp: pred_tcb_at_def2 tcb_bound_refs_def2
                    dest!: symreftype_inverse') apply (fastforce simp: obj_at_def is_ep pred_tcb_at_def2 dest!: idle_no_ex_cap valid_reply_capsD) apply (rule hoare_pre) apply (wp get_simple_ko_wp | wpc | clarsimp)+ apply (clarsimp simp: pred_tcb_at_tcb_at) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s)\<rbrace> receive_ipc t cap is_blocking \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s)\<rbrace> do p <- case cap of EndpointCap ref badge rights \<Rightarrow> return (ref, rights) | _ \<Rightarrow> fail;
ep <- get_endpoint (fst p);
ntfnptr <- get_bound_notification t;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn then complete_signal (the ntfnptr) t else case ep of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst p) \<lparr>receiver_can_grant = AllowGrant \<in> snd p\<rparr>);
set_endpoint (fst p) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst p) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst p)) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd p) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst p) \<lparr>receiver_can_grant = AllowGrant \<in> snd p\<rparr>);
set_endpoint (fst p) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33. cap = EndpointCap x31 x32 x33 \<Longrightarrow> \<lbrace>invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to x31\<rbrace> do ep <- get_endpoint x31;
ntfnptr <- get_bound_notification t;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn then complete_signal (the ntfnptr) t else case ep of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (x31, x33)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (x31, x33)\<rparr>);
set_endpoint (fst (x31, x33)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (x31, x33)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (x31, x33))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (x31, x33)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (x31, x33)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (x31, x33)\<rparr>);
set_endpoint (fst (x31, x33)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep badge rights. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep\<rbrace> do epa <- get_endpoint ep;
ntfnptr <- get_bound_notification t;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn then complete_signal (the ntfnptr) t else case epa of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep badge rights x. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep)\<rbrace> do ntfnptr <- get_bound_notification t;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn then complete_signal (the ntfnptr) t else case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> do ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn then complete_signal (the ntfnptr) t else case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>?B18 ep badge rights x ntfnptr ntfn\<rbrace> if (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn then complete_signal (the ntfnptr) t else case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>?B18 ep badge rights x ntfnptr\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>?B18 ep badge rights x ntfnptr ntfn\<rbrace> if (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn then complete_signal (the ntfnptr) t else case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>?B18 ep badge rights x ntfnptr\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; (\<exists>y. ntfnptr = Some y) \<and> isActive ntfn\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 ep badge rights x ntfnptr ntfn\<rbrace> complete_signal (the ntfnptr) t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn)\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> ?Q21 ep badge rights x ntfnptr ntfn s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn)\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = IdleEP; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?B59 ep badge rights IdleEP ntfnptr ntfn ()\<rbrace> set_endpoint ep (RecvEP [t]) \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = True\<rbrakk> \<Longrightarrow> \<lbrace>?R55 ep badge rights x ntfnptr ntfn\<rbrace> set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>) \<lbrace>?B59 ep badge rights x ntfnptr ntfn\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R54 ep badge rights x ntfnptr ntfn\<rbrace> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; ?R42 ep badge rights x ntfnptr ntfn s\<rbrakk> \<Longrightarrow> (is_blocking = True \<longrightarrow> ?R55 ep badge rights x ntfnptr ntfn s) \<and> (is_blocking = False \<longrightarrow> ?R54 ep badge rights x ntfnptr ntfn s)
 5. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?R43 ep badge rights x ntfnptr ntfn x2\<rbrace> do assert (x2 \<noteq> []);
queue <- return $ tl x2;
sender <- return $ hd x2;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>?R44 ep badge rights x ntfnptr ntfn x3\<rbrace> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (x3 @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 7. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s\<rbrakk> \<Longrightarrow> (x = IdleEP \<longrightarrow> ?R42 ep badge rights x ntfnptr ntfn s) \<and> (\<forall>xa. x = SendEP xa \<longrightarrow> ?R43 ep badge rights x ntfnptr ntfn xa s) \<and> (\<forall>xa. x = RecvEP xa \<longrightarrow> ?R44 ep badge rights x ntfnptr ntfn xa s)
 8. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 9. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 10. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = IdleEP; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?B59 ep badge rights IdleEP ntfnptr ntfn ()\<rbrace> set_endpoint ep (RecvEP [t]) \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = True\<rbrakk> \<Longrightarrow> \<lbrace>?R55 ep badge rights x ntfnptr ntfn\<rbrace> set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>) \<lbrace>?B59 ep badge rights x ntfnptr ntfn\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R54 ep badge rights x ntfnptr ntfn\<rbrace> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; ?R42 ep badge rights x ntfnptr ntfn s\<rbrakk> \<Longrightarrow> (is_blocking = True \<longrightarrow> ?R55 ep badge rights x ntfnptr ntfn s) \<and> (is_blocking = False \<longrightarrow> ?R54 ep badge rights x ntfnptr ntfn s)
 5. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?R43 ep badge rights x ntfnptr ntfn x2\<rbrace> do assert (x2 \<noteq> []);
queue <- return $ tl x2;
sender <- return $ hd x2;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>?R44 ep badge rights x ntfnptr ntfn x3\<rbrace> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (x3 @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 7. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s\<rbrakk> \<Longrightarrow> (x = IdleEP \<longrightarrow> ?R42 ep badge rights x ntfnptr ntfn s) \<and> (\<forall>xa. x = SendEP xa \<longrightarrow> ?R43 ep badge rights x ntfnptr ntfn xa s) \<and> (\<forall>xa. x = RecvEP xa \<longrightarrow> ?R44 ep badge rights x ntfnptr ntfn xa s)
 8. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 9. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 10. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = IdleEP; is_blocking; ?B59 ep badge rights IdleEP ntfnptr ntfn () s\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (Endpoint (RecvEP [t])) and K (is_simple_type (Endpoint (RecvEP [t])))) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (if_live_then_nonz_cap s \<and> (live (Endpoint (RecvEP [t])) \<longrightarrow> ex_nonz_cap_to ep s)) \<and> zombies_final s \<and> sym_refs ((state_refs_of s)(ep := ep_q_refs_of (RecvEP [t]))) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> (obj_at (\<lambda>ko. partial_inv Endpoint ko \<noteq> None) ep and valid_idle) s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s
 2. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = True\<rbrakk> \<Longrightarrow> \<lbrace>?R55 ep badge rights x ntfnptr ntfn\<rbrace> set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>) \<lbrace>?B59 ep badge rights x ntfnptr ntfn\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R54 ep badge rights x ntfnptr ntfn\<rbrace> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; ?R42 ep badge rights x ntfnptr ntfn s\<rbrakk> \<Longrightarrow> (is_blocking = True \<longrightarrow> ?R55 ep badge rights x ntfnptr ntfn s) \<and> (is_blocking = False \<longrightarrow> ?R54 ep badge rights x ntfnptr ntfn s)
 5. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?R43 ep badge rights x ntfnptr ntfn x2\<rbrace> do assert (x2 \<noteq> []);
queue <- return $ tl x2;
sender <- return $ hd x2;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>?R44 ep badge rights x ntfnptr ntfn x3\<rbrace> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (x3 @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 7. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s\<rbrakk> \<Longrightarrow> (x = IdleEP \<longrightarrow> ?R42 ep badge rights x ntfnptr ntfn s) \<and> (\<forall>xa. x = SendEP xa \<longrightarrow> ?R43 ep badge rights x ntfnptr ntfn xa s) \<and> (\<forall>xa. x = RecvEP xa \<longrightarrow> ?R44 ep badge rights x ntfnptr ntfn xa s)
 8. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 9. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 10. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = True\<rbrakk> \<Longrightarrow> \<lbrace>?R55 ep badge rights x ntfnptr ntfn\<rbrace> set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>) \<lbrace>\<lambda>a b. valid_objs b \<and> tcb_at t b \<and> pspace_aligned b \<and> pspace_distinct b \<and> if_live_then_nonz_cap b \<and> (live (Endpoint (RecvEP [t])) \<longrightarrow> ex_nonz_cap_to ep b) \<and> zombies_final b \<and> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else state_refs_of b a) \<and> sym_refs (state_hyp_refs_of b) \<and> valid_mdb b \<and> valid_ioc b \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep b \<and> valid_idle b \<and> only_idle b \<and> if_unsafe_then_cap b \<and> valid_reply_caps b \<and> valid_reply_masters b \<and> valid_global_refs b \<and> valid_arch_state b \<and> valid_irq_node b \<and> valid_irq_handlers b \<and> valid_irq_states b \<and> valid_ioports b \<and> valid_machine_state b \<and> valid_vspace_objs b \<and> valid_arch_caps b \<and> valid_global_objs b \<and> valid_kernel_mappings b \<and> equal_kernel_mappings b \<and> valid_asid_map b \<and> valid_global_vspace_mappings b \<and> pspace_in_kernel_window b \<and> cap_refs_in_kernel_window b \<and> pspace_respects_device_region b \<and> cap_refs_respects_device_region b \<and> cur_tcb b \<and> Q b\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; is_blocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R54 ep badge rights x ntfnptr ntfn\<rbrace> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = IdleEP; ?R42 ep badge rights x ntfnptr ntfn s\<rbrakk> \<Longrightarrow> (is_blocking = True \<longrightarrow> ?R55 ep badge rights x ntfnptr ntfn s) \<and> (is_blocking = False \<longrightarrow> ?R54 ep badge rights x ntfnptr ntfn s)
 4. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?R43 ep badge rights x ntfnptr ntfn x2\<rbrace> do assert (x2 \<noteq> []);
queue <- return $ tl x2;
sender <- return $ hd x2;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>?R44 ep badge rights x ntfnptr ntfn x3\<rbrace> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (x3 @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = IdleEP; (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s\<rbrakk> \<Longrightarrow> (x = IdleEP \<longrightarrow> ?R42 ep badge rights x ntfnptr ntfn s) \<and> (\<forall>xa. x = SendEP xa \<longrightarrow> ?R43 ep badge rights x ntfnptr ntfn xa s) \<and> (\<forall>xa. x = RecvEP xa \<longrightarrow> ?R44 ep badge rights x ntfnptr ntfn xa s)
 7. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 8. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 9. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = IdleEP; ko_at (Endpoint IdleEP) ep s \<and> invs s \<and> Q s \<and> st_tcb_at active t s \<and> ex_nonz_cap_to t s \<and> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s \<and> ex_nonz_cap_to ep s\<rbrakk> \<Longrightarrow> is_blocking \<longrightarrow> valid_objs s \<and> valid_tcb_state (BlockedOnReceive ep \<lparr>receiver_can_grant = AllowGrant \<in> rights\<rparr>) s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> tcb_at t s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> valid_idle s \<and> t \<noteq> idle_thread s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> \<not> has_reply_cap t s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s
 2. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep_at ep s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a)
 2. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; ep \<noteq> t\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a)
 2. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; ep \<noteq> t; \<exists>ko. Endpoint IdleEP = ko \<and> state_refs_of s ep = refs_of ko\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a)
 2. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; ep \<noteq> t; \<exists>ko. Endpoint IdleEP = ko \<and> state_refs_of s ep = refs_of ko; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPRecv)} else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a)
 2. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; ep \<noteq> t; \<exists>ko. Endpoint IdleEP = ko \<and> state_refs_of s ep = refs_of ko; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; (y, tp) \<in> (if x = ep then {(t, EPRecv)} else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x); (y, tp) \<notin> state_refs_of s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = ep then {(t, EPRecv)} else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>ep badge rights ntfnptr ntfn s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; ep \<noteq> t; \<exists>ko. Endpoint IdleEP = ko \<and> state_refs_of s ep = refs_of ko; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = ep then {(t, EPRecv)} else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then {(t, EPRecv)} else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 3. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep \<noteq> t
 4. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 5. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 7. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; ep \<noteq> t; \<exists>ko. Endpoint IdleEP = ko \<and> state_refs_of s ep = refs_of ko; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = ep then {(t, EPRecv)} else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then {(t, EPRecv)} else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; ep \<noteq> t; state_refs_of s ep = {}; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; (y, tp) \<in> state_refs_of s t; y = ep \<longrightarrow> tp \<noteq> TCBBlockedRecv; tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> (t, symreftype tp) \<in> state_refs_of s t \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ep \<longrightarrow> symreftype tp \<noteq> EPRecv) \<and> (y \<noteq> ep \<longrightarrow> (t, symreftype tp) \<notin> state_refs_of s y))
 2. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep \<noteq> t
 2. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint IdleEP) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; kheap s ep = Some (Endpoint IdleEP); valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn x2. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (SendEP x2)) ep and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep)\<rbrace> do y <- assert (x2 \<noteq> []);
y <- set_endpoint ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2));
sender_state <- get_thread_state (hd x2);
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer (hd x2) (Some ep) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap (hd x2) t (AllowGrant \<in> rights) else set_thread_state (hd x2) Inactive else do y <- set_thread_state (hd x2) Running;
do_extended_op (possible_switch_to (hd x2))
od
od \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn x2 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = SendEP x2; ko_at (Endpoint (SendEP x2)) ep s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s \<and> st_tcb_at active t s \<and> ex_nonz_cap_to t s \<and> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s \<and> ex_nonz_cap_to ep s\<rbrakk> \<Longrightarrow> x2 \<noteq> [] \<longrightarrow> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s \<and> hd x2 \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> sym_refs (\<lambda>a. if a = hd x2 then {r \<in> if hd x2 = ep then ep_q_refs_of (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) else state_refs_of s (hd x2). snd r = TCBBound} else if a = ep then ep_q_refs_of (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) else state_refs_of s a) \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s \<and> hd x2 \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> hd x2 \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> tcb_at t s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) (hd x2) s \<and> tcb_at t s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> tcb_at t s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> tcb_at (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s \<and> tcb_at (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> sym_refs (\<lambda>a. if a = hd x2 then {r \<in> if hd x2 = ep then ep_q_refs_of (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) else state_refs_of s (hd x2). snd r = TCBBound} else if a = ep then ep_q_refs_of (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) else state_refs_of s a) \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> hd x2 \<noteq> idle_thread s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> tcb_at (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s \<and> ex_nonz_cap_to (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> sym_refs (\<lambda>a. if a = hd x2 then {r \<in> if hd x2 = ep then ep_q_refs_of (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) else state_refs_of s (hd x2). snd r = TCBBound} else if a = ep then ep_q_refs_of (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) else state_refs_of s a) \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> hd x2 \<noteq> idle_thread s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> tcb_at (hd x2) s \<and> valid_ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2)) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) (hd x2) s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (SendEP (y # ys))) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s\<rbrakk> \<Longrightarrow> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> ex_nonz_cap_to y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (SendEP (y # ys))) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> ex_nonz_cap_to y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (SendEP (y # ys))) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s); \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_hyp_refs_of s ep = hyp_refs_of ko \<and> (\<forall>(x, tp)\<in>hyp_refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s)\<rbrakk> \<Longrightarrow> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> ex_nonz_cap_to y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (SendEP (y # ys))) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s); \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_hyp_refs_of s ep = hyp_refs_of ko \<and> (\<forall>(x, tp)\<in>hyp_refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s); state_refs_of s ep = refs_of (Endpoint (SendEP (y # ys)))\<rbrakk> \<Longrightarrow> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> ex_nonz_cap_to y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (SendEP (y # ys))) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s); \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_hyp_refs_of s ep = hyp_refs_of ko \<and> (\<forall>(x, tp)\<in>hyp_refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s); state_refs_of s ep = refs_of (Endpoint (SendEP (y # ys))); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys)))\<rbrakk> \<Longrightarrow> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> ex_nonz_cap_to y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys ko. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s); \<exists>ko. Endpoint (SendEP (y # ys)) = ko \<and> state_hyp_refs_of s ep = hyp_refs_of ko \<and> (\<forall>(x, tp)\<in>hyp_refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s); state_refs_of s ep = refs_of (Endpoint (SendEP (y # ys))); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some ko; Endpoint (SendEP (y # ys)) = ko; valid_obj ep ko s\<rbrakk> \<Longrightarrow> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> ex_nonz_cap_to y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s y. snd r = TCBBound} else if a = ep then ep_q_refs_of (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) else state_refs_of s a) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> tcb_at y s \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (y # ys))) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); valid_ep (SendEP (y # ys)) s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s\<rbrakk> \<Longrightarrow> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> ex_nonz_cap_to y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); valid_ep (SendEP (y # ys)) s; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s\<rbrakk> \<Longrightarrow> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> distinct ys \<and> (\<forall>t\<in>set ys. tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr; y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> y \<noteq> t \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> sym_refs (\<lambda>a. if a = y then {r \<in> if y = ep then set ys \<times> {EPSend} else state_refs_of s y. snd r = TCBBound} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> y \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) y s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s
 2. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; obj_at (tcb_ntfn_is_bound ntfnptra) y s; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> sym_refs (\<lambda>a. if a = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a)
 2. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if a = ep then set ys \<times> {EPSend} else state_refs_of s a)
 2. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko x ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko; (ya, tp) \<in> (if x = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if x = ep then set ys \<times> {EPSend} else state_refs_of s x); (ya, tp) \<notin> state_refs_of s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if ya = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if ya = ep then set ys \<times> {EPSend} else state_refs_of s ya)
 2. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko x ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko; (ya, tp) \<in> state_refs_of s x; (ya, tp) \<notin> (if x = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if x = ep then set ys \<times> {EPSend} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if ya = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if ya = ep then set ys \<times> {EPSend} else state_refs_of s ya)
 3. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 4. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 5. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko x ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko; (ya, tp) \<in> state_refs_of s x; (ya, tp) \<notin> (if x = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if x = ep then set ys \<times> {EPSend} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if ya = y then {r. snd r = TCBBound \<and> r \<in> (if y = ep then set ys \<times> {EPSend} else insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra))} else if ya = ep then set ys \<times> {EPSend} else state_refs_of s ya)
 2. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s ys tcb tcba ntfnptra pl ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (ep # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (ep # ys))); kheap s ep = Some (Endpoint (SendEP (ep # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; ep \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; ep \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb ep s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; ep \<noteq> idle_thread s; insert (ep, EPSend) (set ys \<times> {EPSend}) = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb (Endpoint (SendEP (ep # ys))); tcb_ntfn_is_bound ntfnptra (Endpoint (SendEP (ep # ys))); (ya, tp) \<in> tcb_bound_refs ntfnptra; ya \<noteq> ep; (ep, symreftype tp) \<in> state_refs_of s ya\<rbrakk> \<Longrightarrow> False
 2. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko; (ya, tp) \<in> tcb_bound_refs ntfnptra; y \<noteq> ep; tp = TCBBound \<longrightarrow> (ya, TCBBound) \<notin> tcb_bound_refs ntfnptra; ya \<noteq> ep\<rbrakk> \<Longrightarrow> (ya = y \<longrightarrow> symreftype tp = TCBBound \<longrightarrow> (y, TCBBound) \<notin> tcb_bound_refs ntfnptra) \<and> (ya \<noteq> y \<longrightarrow> (y, symreftype tp) \<notin> state_refs_of s ya)
 3. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko; ya = y \<and> tp = EPSend \<or> ya \<in> set ys \<and> tp = EPSend; ep \<noteq> y; ya \<in> set ys \<longrightarrow> tp \<noteq> EPSend\<rbrakk> \<Longrightarrow> (ya = ep \<longrightarrow> ep \<in> set ys \<longrightarrow> symreftype tp \<noteq> EPSend) \<and> (ya \<noteq> ep \<longrightarrow> (ya = y \<longrightarrow> symreftype tp = TCBBound \<longrightarrow> (ep, TCBBound) \<notin> tcb_bound_refs ntfnptra) \<and> (ya \<noteq> y \<longrightarrow> (ep, symreftype tp) \<notin> state_refs_of s ya))
 4. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s ys tcb tcba ntfnptra pl ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (ep # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (ep # ys))); kheap s ep = Some (Endpoint (SendEP (ep # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; ep \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; ep \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb ep s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; ep \<noteq> idle_thread s; insert (ep, EPSend) (set ys \<times> {EPSend}) = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb (Endpoint (SendEP (ep # ys))); tcb_ntfn_is_bound ntfnptra (Endpoint (SendEP (ep # ys))); (ya, tp) \<in> tcb_bound_refs ntfnptra; ya \<noteq> ep; (ep, symreftype tp) \<in> state_refs_of s ya\<rbrakk> \<Longrightarrow> False
 2. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko; (ya, tp) \<in> tcb_bound_refs ntfnptra; y \<noteq> ep; tp = TCBBound \<longrightarrow> (ya, TCBBound) \<notin> tcb_bound_refs ntfnptra; ya \<noteq> ep\<rbrakk> \<Longrightarrow> (ya = y \<longrightarrow> symreftype tp = TCBBound \<longrightarrow> (y, TCBBound) \<notin> tcb_bound_refs ntfnptra) \<and> (ya \<noteq> y \<longrightarrow> (y, symreftype tp) \<notin> state_refs_of s ya)
 3. \<And>ep badge rights ntfnptr ntfn s y ys tcb tcba ntfnptra pl ko ya tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> \<exists>ko. kheap s x = Some ko \<and> (ep, symreftype tp) \<in> hyp_refs_of ko; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); \<forall>x\<in>set ys. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to y s; \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; y \<noteq> t; get_tcb t s = Some tcb; active (tcb_state tcb); get_tcb y s = Some tcba; tcb_state tcba = BlockedOnSend ep pl; y \<noteq> idle_thread s; state_refs_of s y = insert (ep, TCBBlockedSend) (tcb_bound_refs ntfnptra); t \<noteq> idle_thread s; idle_thread s \<notin> set ys; is_tcb ko; kheap s y = Some ko; tcb_ntfn_is_bound ntfnptra ko; ya = y \<and> tp = EPSend \<or> ya \<in> set ys \<and> tp = EPSend; ep \<noteq> y; ya \<in> set ys \<longrightarrow> tp \<noteq> EPSend\<rbrakk> \<Longrightarrow> (ya = ep \<longrightarrow> ep \<in> set ys \<longrightarrow> symreftype tp \<noteq> EPSend) \<and> (ya \<noteq> ep \<longrightarrow> (ya = y \<longrightarrow> symreftype tp = TCBBound \<longrightarrow> (ep, TCBBound) \<notin> tcb_bound_refs ntfnptra) \<and> (ya \<noteq> y \<longrightarrow> (ep, symreftype tp) \<notin> state_refs_of s ya))
 4. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 5. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 6. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t \<and> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> t
 2. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s ys tcb tcba tcbb pl ntfnptra. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (t # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (t, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (t # ys))); kheap s ep = Some (Endpoint (SendEP (t # ys))); \<forall>x\<in>set ys. \<exists>tcb. ko_at (TCB tcb) x s \<and> (\<exists>pl. tcb_state tcb = BlockedOnSend ep pl); ex_nonz_cap_to t s; tcb_at t s; \<forall>t\<in>set ys. tcb_at t s; t \<notin> set ys; distinct ys; ko_at (TCB tcb) t s; active (tcb_state tcb); ko_at (TCB tcba) t s; tcb_state tcba = BlockedOnSend ep pl; ko_at (TCB tcbb) t s; set_option (tcb_bound_notification tcbb) \<times> {TCBBound} = insert (ep, TCBBlockedSend) (set_option ntfnptra \<times> {TCBBound}); obj_at (tcb_ntfn_is_bound ntfnptra) t s; state_refs_of s t = insert (ep, TCBBlockedSend) (set_option ntfnptra \<times> {TCBBound})\<rbrakk> \<Longrightarrow> False
 2. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 3. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> y \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> idle_thread s \<notin> set ys
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn s y ys. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; \<forall>x\<in>hyp_refs_of (Endpoint (SendEP (y # ys))). case x of (x, tp) \<Rightarrow> obj_at (\<lambda>ko. (ep, symreftype tp) \<in> hyp_refs_of ko) x s; state_refs_of s ep = insert (y, EPSend) (set ys \<times> {EPSend}); state_hyp_refs_of s ep = hyp_refs_of (Endpoint (SendEP (y # ys))); kheap s ep = Some (Endpoint (SendEP (y # ys))); st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) y s; \<forall>x\<in>set ys. st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend ep pl) x s; ex_nonz_cap_to y s; tcb_at y s; \<forall>t\<in>set ys. tcb_at t s; y \<notin> set ys; distinct ys; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; \<exists>ts ntfnptr. (\<exists>pl. ts = BlockedOnSend ep pl) \<and> obj_at (tcb_ntfn_is_bound ntfnptr) y s \<and> state_refs_of s y = tcb_st_refs_of ts \<union> tcb_bound_refs ntfnptr\<rbrakk> \<Longrightarrow> idle_thread s \<notin> set ys
 2. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; \<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn); x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))\<rbrace> case x of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP [t])
od | False \<Rightarrow> do_nbrecv_failed_transfer t | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint (fst (ep, rights)) $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some (fst (ep, rights))) (sender_badge data) (sender_can_grant data) t;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender t (AllowGrant \<in> snd (ep, rights)) else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (queue @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. invs s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at (Endpoint (RecvEP x3)) ep and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep)\<rbrace> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (x3 @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn x3. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = RecvEP x3\<rbrakk> \<Longrightarrow> \<lbrace>?Q7510 ep badge rights x ntfnptr ntfn x3\<rbrace> case is_blocking of True \<Rightarrow> do set_thread_state t (BlockedOnReceive (fst (ep, rights)) \<lparr>receiver_can_grant = AllowGrant \<in> snd (ep, rights)\<rparr>);
set_endpoint (fst (ep, rights)) (RecvEP (x3 @ [t]))
od | False \<Rightarrow> do_nbrecv_failed_transfer t \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s\<rbrace>
 2. \<And>ep badge rights x ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = RecvEP x3; (ko_at (Endpoint (RecvEP x3)) ep and (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_ioports and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep)) s\<rbrakk> \<Longrightarrow> ?Q7510 ep badge rights x ntfnptr ntfn x3 s
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights x ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; x = RecvEP x3; ko_at (Endpoint (RecvEP x3)) ep s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_ioports s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> Q s \<and> st_tcb_at active t s \<and> ex_nonz_cap_to t s \<and> cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s \<and> ex_nonz_cap_to ep s\<rbrakk> \<Longrightarrow> is_blocking \<longrightarrow> valid_tcb_state (BlockedOnReceive ep \<lparr>receiver_can_grant = AllowGrant \<in> rights\<rparr>) s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> tcb_at t s \<and> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> ep_at ep s \<and> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> (st_tcb_at (\<lambda>st. \<not> halted st) t s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = t) (t, tcb_cnode_index 2) s) \<and> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; state_refs_of s ep = refs_of (Endpoint (RecvEP x3))\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; state_refs_of s ep = refs_of (Endpoint (RecvEP x3)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; state_refs_of s ep = refs_of (Endpoint (RecvEP x3)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; state_refs_of s ep = refs_of (Endpoint (RecvEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of (Endpoint (RecvEP x3)). obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s ko. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; state_refs_of s ep = refs_of (Endpoint (RecvEP x3)); bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; state_refs_of s ep = refs_of (Endpoint (RecvEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of (Endpoint (RecvEP x3)). obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s); kheap s ep = Some ko; Endpoint (RecvEP x3) = ko; valid_obj ep ko s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3\<rbrakk> \<Longrightarrow> t \<notin> set x3
 2. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s ko koa. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = refs_of ko) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; x3 \<noteq> []; distinct x3; t \<in> set x3; (ep, TCBBlockedRecv) \<in> refs_of ko; refs_of koa = refs_of ko; is_tcb koa; state_refs_of s t = refs_of ko\<rbrakk> \<Longrightarrow> False
 2. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s ko koa tcb tcba. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; x3 \<noteq> []; distinct x3; t \<in> set x3; (ep, TCBBlockedRecv) \<in> refs_of ko; refs_of koa = refs_of ko; is_tcb koa; state_refs_of s t = refs_of ko; ko_at (TCB tcb) t s; active (tcb_state tcb); ko_at (TCB tcba) t s; set_option (tcb_bound_notification tcba) \<times> {TCBBound} = refs_of ko\<rbrakk> \<Longrightarrow> False
 2. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if a = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s a) \<and> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; (y, tp) \<in> (if x = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x); (y, tp) \<notin> state_refs_of s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>ep badge rights ntfnptr ntfn x3 s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 3. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s y tp. \<lbrakk>y \<in> set x3 \<longrightarrow> tp \<noteq> EPRecv; cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; y = t \<and> tp = EPRecv \<or> y \<in> set x3 \<and> tp = EPRecv\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> (t = ep \<longrightarrow> symreftype tp = EPRecv \<or> ep \<in> set x3 \<and> symreftype tp = EPRecv) \<and> (t \<noteq> ep \<longrightarrow> symreftype tp = TCBBlockedRecv \<or> (ep, symreftype tp) \<in> state_refs_of s t \<and> symreftype tp = TCBBound)) \<and> (y \<noteq> t \<longrightarrow> (y = ep \<longrightarrow> ep = t \<and> symreftype tp = EPRecv \<or> ep \<in> set x3 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ep \<longrightarrow> (ep, symreftype tp) \<in> state_refs_of s y))
 2. \<And>ep badge rights ntfnptr ntfn x3 s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 3. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s y tp. \<lbrakk>y \<in> set x3 \<longrightarrow> tp \<noteq> EPRecv; cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; y = t \<and> tp = EPRecv \<or> y \<in> set x3 \<and> tp = EPRecv; y = t\<rbrakk> \<Longrightarrow> (t = ep \<longrightarrow> symreftype tp = EPRecv \<or> ep \<in> set x3 \<and> symreftype tp = EPRecv) \<and> (t \<noteq> ep \<longrightarrow> symreftype tp = TCBBlockedRecv \<or> (ep, symreftype tp) \<in> state_refs_of s t \<and> symreftype tp = TCBBound)
 2. \<And>ep badge rights ntfnptr ntfn x3 s y tp. \<lbrakk>y \<in> set x3 \<longrightarrow> tp \<noteq> EPRecv; cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; y = t \<and> tp = EPRecv \<or> y \<in> set x3 \<and> tp = EPRecv\<rbrakk> \<Longrightarrow> y \<noteq> t \<longrightarrow> (y = ep \<longrightarrow> ep = t \<and> symreftype tp = EPRecv \<or> ep \<in> set x3 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ep \<longrightarrow> (ep, symreftype tp) \<in> state_refs_of s y)
 3. \<And>ep badge rights ntfnptr ntfn x3 s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 4. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 5. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s y tp. \<lbrakk>y \<in> set x3 \<longrightarrow> tp \<noteq> EPRecv; cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; y = t \<and> tp = EPRecv \<or> y \<in> set x3 \<and> tp = EPRecv\<rbrakk> \<Longrightarrow> y \<noteq> t \<longrightarrow> (y = ep \<longrightarrow> ep = t \<and> symreftype tp = EPRecv \<or> ep \<in> set x3 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ep \<longrightarrow> (ep, symreftype tp) \<in> state_refs_of s y)
 2. \<And>ep badge rights ntfnptr ntfn x3 s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 3. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 4. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s x y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; (y, tp) \<in> state_refs_of s x; (y, tp) \<notin> (if x = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if x = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then insert (t, EPRecv) (set x3 \<times> {EPRecv}) else if y = t then insert (ep, TCBBlockedRecv) {r \<in> state_refs_of s t. snd r = TCBBound} else state_refs_of s y)
 2. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s y tp. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3; (y, tp) \<in> state_refs_of s t; t \<noteq> ep; y = ep \<longrightarrow> tp \<noteq> TCBBlockedRecv; tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> (t, symreftype tp) \<in> state_refs_of s t \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ep \<longrightarrow> symreftype tp \<noteq> EPRecv) \<and> (y \<noteq> ep \<longrightarrow> (t, symreftype tp) \<notin> state_refs_of s y))
 2. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 3. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights ntfnptr ntfn x3 s. \<lbrakk>cap = EndpointCap ep badge rights; ntfnptr = None \<or> \<not> isActive ntfn; ko_at (Endpoint (RecvEP x3)) ep s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_ioports s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; is_blocking; bound_tcb_at (\<lambda>x. tcb_bound_refs x = state_refs_of s t) t s; kheap s ep = Some (Endpoint (RecvEP x3)); state_refs_of s ep = set x3 \<times> {EPRecv}; \<forall>x\<in>set x3. obj_at (\<lambda>ko. (ep, TCBBlockedRecv) \<in> refs_of ko) x s; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at t s; distinct x3; t \<notin> set x3\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep s \<and> t \<noteq> idle_thread s \<and> \<not> has_reply_cap t s
 2. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep badge rights x ntfnptr. cap = EndpointCap ep badge rights \<Longrightarrow> \<lbrace>?Q13199 ep badge rights x ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn \<longrightarrow> (invs and tcb_at t) s \<and> Q s) \<and> (\<not> ((\<exists>y. ntfnptr = Some y) \<and> isActive ntfn) \<longrightarrow> (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s))) s)\<rbrace>
 2. \<And>ep badge rights x ntfnptr s. \<lbrakk>cap = EndpointCap ep badge rights; (bound_tcb_at ((=) ntfnptr) t and (ko_at (Endpoint x) ep and (invs and Q and st_tcb_at active t and ex_nonz_cap_to t and cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) and ex_nonz_cap_to ep))) s\<rbrakk> \<Longrightarrow> ?Q13199 ep badge rights x ntfnptr s proof (prove)
goal (1 subgoal):
 1. \<And>ep badge rights x s xa ntfn. \<lbrakk>cap = EndpointCap ep badge rights; bound_tcb_at ((=) (Some xa)) t s; ko_at (Endpoint x) ep s; invs s; Q s; st_tcb_at active t s; ex_nonz_cap_to t s; cte_wp_at ((=) NullCap) (t, tcb_cnode_index 3) s; ex_nonz_cap_to ep s; ko_at (Notification ntfn) xa s; isActive ntfn\<rbrakk> \<Longrightarrow> tcb_at t s proof (prove)
goal:
No subgoals!