theory Ipc_R

lemma si_invs'[wp]:
  "\<lbrace>invs' and st_tcb_at' simple' t
          and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p))
          and sch_act_not t
          and ex_nonz_cap_to' ep and ex_nonz_cap_to' t\<rbrace>
  sendIPC bl call ba cg cgr t ep
  \<lbrace>\<lambda>rv. invs'\<rbrace>" supply if_split[split del] apply (simp add: sendIPC_def split del: if_split) apply (rule hoare_seq_ext [OF _ get_ep_sp']) apply (case_tac epa)
    \<comment> \<open>epa = RecvEP\<close> apply simp apply (rename_tac list) apply (case_tac list) apply simp apply (simp split del: if_split add: invs'_def valid_state'_def) apply (rule hoare_pre) apply (rule_tac P="a\<noteq>t" in hoare_gen_asm) apply (wp valid_irq_node_lift
               sts_valid_objs' set_ep_valid_objs' setEndpoint_valid_mdb' sts_st_tcb' sts_sch_act'
               possibleSwitchTo_sch_act_not sts_valid_queues setThreadState_ct_not_inQ
               possibleSwitchTo_ksQ' possibleSwitchTo_ct_not_inQ hoare_vcg_all_lift sts_ksQ'
               hoare_convert_imp [OF doIPCTransfer_sch_act doIPCTransfer_ct']
               hoare_convert_imp [OF setEndpoint_nosch setEndpoint_ct']
               hoare_drop_imp [where f="threadGet tcbFault t"]
             | rule_tac f="getThreadState a" in hoare_drop_imp
             | wp (once) hoare_drop_imp[where R="\<lambda>_ _. call"]
               hoare_drop_imp[where R="\<lambda>_ _. \<not> call"]
               hoare_drop_imp[where R="\<lambda>_ _. cg"]
             | simp    add: valid_tcb_state'_def case_bool_If
                            case_option_If
                      cong: if_cong
                 split del: if_split
             | wp (once) sch_act_sane_lift tcb_in_cur_domain'_lift hoare_vcg_const_imp_lift)+ apply (clarsimp simp: pred_tcb_at' cong: conj_cong imp_cong
               split del: if_split) apply (frule obj_at_valid_objs', clarsimp) apply (frule(1) sym_refs_ko_atD') apply (clarsimp simp: projectKOs valid_obj'_def valid_ep'_def
                          st_tcb_at_refs_of_rev' pred_tcb_at'
                          conj_comms fun_upd_def[symmetric]
               split del: if_split) apply (frule pred_tcb_at') apply (drule simple_st_tcb_at_state_refs_ofD' st_tcb_at_state_refs_ofD')+ apply (clarsimp simp: valid_pspace'_splits) apply (subst fun_upd_idem[where x=t]) apply (clarsimp split: if_split) apply (rule conjI, clarsimp simp: obj_at'_def projectKOs) apply (drule bound_tcb_at_state_refs_ofD') apply (fastforce simp: tcb_bound_refs'_def) apply (subgoal_tac "ex_nonz_cap_to' a s") prefer 2 apply (clarsimp elim!: if_live_state_refsE) apply clarsimp apply (rule conjI) apply (drule bound_tcb_at_state_refs_ofD') apply (fastforce simp: tcb_bound_refs'_def set_eq_subset) apply (clarsimp simp: conj_ac) apply (rule conjI, clarsimp simp: idle'_no_refs) apply (rule conjI, clarsimp simp: global'_no_ex_cap) apply (rule conjI) apply (rule impI) apply (frule(1) ct_not_in_epQueue, clarsimp, clarsimp) apply (clarsimp) apply (simp add: ep_redux_simps') apply (rule conjI, clarsimp split: if_split) apply (rule conjI, fastforce simp: tcb_bound_refs'_def set_eq_subset) apply (clarsimp, erule delta_sym_refs;
            solves\<open>auto simp: symreftype_inverse' tcb_bound_refs'_def split: if_split_asm\<close>) apply (solves\<open>clarsimp split: list.splits\<close>)
   \<comment> \<open>epa = IdleEP\<close> apply (cases bl) apply (simp add: invs'_def valid_state'_def) apply (rule hoare_pre, wp valid_irq_node_lift) apply (simp add: valid_ep'_def) apply (wp valid_irq_node_lift sts_sch_act' sts_valid_queues
               setThreadState_ct_not_inQ) apply (clarsimp simp: valid_tcb_state'_def pred_tcb_at') apply (rule conjI, clarsimp elim!: obj_at'_weakenE) apply (subgoal_tac "ep \<noteq> t") apply (drule simple_st_tcb_at_state_refs_ofD' ko_at_state_refs_ofD'
                  bound_tcb_at_state_refs_ofD')+ apply (rule conjI, erule delta_sym_refs) apply (auto simp: tcb_bound_refs'_def symreftype_inverse'
                  split: if_split_asm)[2] apply (fastforce simp: global'_no_ex_cap) apply (clarsimp simp: pred_tcb_at'_def obj_at'_def projectKOs) apply simp apply wp apply simp
  \<comment> \<open>epa = SendEP\<close> apply (cases bl) apply (simp add: invs'_def valid_state'_def) apply (rule hoare_pre, wp valid_irq_node_lift) apply (simp add: valid_ep'_def) apply (wp hoare_vcg_const_Ball_lift valid_irq_node_lift sts_sch_act'
              sts_valid_queues setThreadState_ct_not_inQ) apply (clarsimp simp: valid_tcb_state'_def pred_tcb_at') apply (rule conjI, clarsimp elim!: obj_at'_weakenE) apply (frule obj_at_valid_objs', clarsimp) apply (frule(1) sym_refs_ko_atD') apply (frule pred_tcb_at') apply (drule simple_st_tcb_at_state_refs_ofD') apply (drule bound_tcb_at_state_refs_ofD') apply (clarsimp simp: valid_obj'_def valid_ep'_def
                         projectKOs st_tcb_at_refs_of_rev') apply (rule conjI, clarsimp) apply (drule (1) bspec) apply (clarsimp dest!: st_tcb_at_state_refs_ofD' bound_tcb_at_state_refs_ofD'
                     simp: tcb_bound_refs'_def) apply (clarsimp simp: set_eq_subset) apply (rule conjI, erule delta_sym_refs) subgoal by (fastforce simp: obj_at'_def projectKOs symreftype_inverse'
                     split: if_split_asm) apply (fastforce simp: tcb_bound_refs'_def symreftype_inverse'
                    split: if_split_asm) apply (fastforce simp: global'_no_ex_cap idle'_not_queued) apply (simp | wp)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t\<rbrace> sendIPC bl call ba cg cgr t ep \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t\<rbrace> sendIPC bl call ba cg cgr t ep \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t\<rbrace> do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>epa. \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa x1. epa = Structures_H.endpoint.RecvEP x1 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa x1. epa = Structures_H.endpoint.RecvEP x1 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP x1) ep\<rbrace> case x1 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa list. epa = Structures_H.endpoint.RecvEP list \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP list) ep\<rbrace> case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>epa list. \<lbrakk>epa = Structures_H.endpoint.RecvEP list; list = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP list) ep\<rbrace> case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa list a lista. \<lbrakk>epa = Structures_H.endpoint.RecvEP list; list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP list) ep\<rbrace> case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa list a lista. \<lbrakk>epa = Structures_H.endpoint.RecvEP list; list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP list) ep\<rbrace> case list of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa list a lista. \<lbrakk>epa = Structures_H.endpoint.RecvEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep\<rbrace> do y <- setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista);
recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) ba cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>epa list a lista. \<lbrakk>epa = Structures_H.endpoint.RecvEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q6 epa list a lista\<rbrace> do y <- setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista);
recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) ba cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>epa list a lista s. \<lbrakk>epa = Structures_H.endpoint.RecvEP (a # lista); list = a # lista; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep) s\<rbrakk> \<Longrightarrow> ?Q6 epa list a lista s
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>epa list a lista. \<lbrakk>epa = Structures_H.endpoint.RecvEP (a # lista); list = a # lista; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?P'9 epa list a lista\<rbrace> do y <- setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista);
recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) ba cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od \<lbrace>\<lambda>rv. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>epa list a lista s. \<lbrakk>epa = Structures_H.endpoint.RecvEP (a # lista); list = a # lista; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep) s\<rbrakk> \<Longrightarrow> (?P'9 epa list a lista and K (a \<noteq> t)) s
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa list a lista s. \<lbrakk>epa = Structures_H.endpoint.RecvEP (a # lista); list = a # lista; valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> sch_act_not t s \<and> ex_nonz_cap_to' ep s \<and> ex_nonz_cap_to' t s \<and> ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s\<rbrakk> \<Longrightarrow> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>b. if b = t then {r \<in> if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t. snd r = TCBBound} else if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> ex_nonz_cap_to' a s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> ex_nonz_cap_to' a s \<and> tcb_at' a s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> a \<noteq> ksIdleThread s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> t \<noteq> ksIdleThread s \<and> a \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> (cgr \<longrightarrow> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>b. if b = t then {r \<in> if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t. snd r = TCBBound} else if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> ex_nonz_cap_to' a s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> ex_nonz_cap_to' a s \<and> tcb_at' a s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> a \<noteq> ksIdleThread s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> t \<noteq> ksIdleThread s \<and> a \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> tcb_at' t s) \<and> (\<not> cg \<and> \<not> cgr \<longrightarrow> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>b. if b = t then {r \<in> if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t. snd r = TCBBound} else if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> ex_nonz_cap_to' a s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> a \<noteq> ksIdleThread s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s) \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>b. if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> ex_nonz_cap_to' a s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> a \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> a \<noteq> t
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s\<rbrakk> \<Longrightarrow> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_mdb' s \<and> sym_refs (\<lambda>b. if b = t then {r \<in> if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t. snd r = TCBBound} else if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> ex_nonz_cap_to' a s \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs (\<lambda>b. if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> a \<noteq> t
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; \<exists>k. k = Structures_H.endpoint.RecvEP (a # lista) \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s)\<rbrakk> \<Longrightarrow> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_mdb' s \<and> sym_refs (\<lambda>b. if b = t then {r \<in> if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t. snd r = TCBBound} else if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> ex_nonz_cap_to' a s \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs (\<lambda>b. if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> a \<noteq> t
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; \<exists>k. k = Structures_H.endpoint.RecvEP (a # lista) \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s ep = refs_of' (injectKOS (Structures_H.endpoint.RecvEP (a # lista))) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.RecvEP (a # lista))). ko_wp_at' (\<lambda>ko. (ep, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) s \<and> tcb_at' a s \<and> valid_objs' s \<and> valid_mdb' s \<and> sym_refs (\<lambda>b. if b = t then {r \<in> if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t. snd r = TCBBound} else if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> ex_nonz_cap_to' a s \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs (\<lambda>b. if b = a then {r \<in> if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a. snd r = TCBBound} else if b = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s b) \<and> a \<noteq> t
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) a s; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a)})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a)}, t := {r. snd r = TCBBound \<and> r \<in> (if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t)}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) a s; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a)})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a)}, t := {r. snd r = TCBBound \<and> r \<in> (if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t)}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; \<exists>ts ntfnptr. (\<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) a s \<and> state_refs_of' s a = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a)})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s a)}, t := {r. snd r = TCBBound \<and> r \<in> (if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t)}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}, t := {r. snd r = TCBBound \<and> r \<in> (if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t)}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) t = {r. snd r = TCBBound \<and> r \<in> (if t = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else state_refs_of' s t)}
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> (t = ep \<longrightarrow> ep \<noteq> a \<longrightarrow> ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) = {r. snd r = TCBBound \<and> r \<in> ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)}) \<and> (t \<noteq> ep \<longrightarrow> t \<noteq> a \<longrightarrow> state_refs_of' s t = {r. snd r = TCBBound \<and> r \<in> state_refs_of' s t})
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> t \<noteq> ep \<longrightarrow> t \<noteq> a \<longrightarrow> state_refs_of' s t = {r. snd r = TCBBound \<and> r \<in> state_refs_of' s t}
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ep \<longrightarrow> t \<noteq> a \<longrightarrow> state_refs_of' s t = {r. snd r = TCBBound \<and> r \<in> state_refs_of' s t}
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' a s \<and> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> a \<noteq> t \<and> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> a \<noteq> t
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s; \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> a \<noteq> t
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))}))
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> a \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a) \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> a
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s; ksSchedulerAction s = ResumeCurrentThread\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> a
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s; ksSchedulerAction s = ResumeCurrentThread; ksCurThread s \<notin> set (epQueue (Structures_H.endpoint.RecvEP (a # lista)))\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> a
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista), a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then ep_q_refs_of' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> sym_refs ((state_refs_of' s)(ep := set lista \<times> {EPRecv}, a := {r. snd r = TCBBound \<and> r \<in> (if a = ep then set lista \<times> {EPRecv} else insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr))})) \<and> (case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> (a = ep \<longrightarrow> sym_refs ((state_refs_of' s)(ep := {r. snd r = TCBBound \<and> r \<in> set lista \<times> {EPRecv}}))) \<and> (a \<noteq> ep \<longrightarrow> sym_refs ((state_refs_of' s)(ep := set lista \<times> {EPRecv}, a := {r. snd r = TCBBound \<and> (r = (ep, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr)})))
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> a \<noteq> ep \<longrightarrow> sym_refs ((state_refs_of' s)(ep := set lista \<times> {EPRecv}, a := {r. snd r = TCBBound \<and> (r = (ep, TCBBlockedRecv) \<or> r \<in> tcb_bound_refs' ntfnptr)}))
 2. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts
 3. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a lista s ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.RecvEP (a # lista)) ep s; distinct lista; a \<notin> set lista; state_refs_of' s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); \<forall>x\<in>set lista. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ep a) x s; \<forall>t\<in>set lista. tcb_at' t s; tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; obj_at' (tcb_ntfn_is_bound' ntfnptr) a s; state_refs_of' s a = insert (ep, TCBBlockedRecv) (tcb_bound_refs' ntfnptr); ex_nonz_cap_to' a s\<rbrakk> \<Longrightarrow> case case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts
 2. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>epa. epa = Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. bl \<Longrightarrow> \<lbrace>(\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' Structures_H.endpoint.IdleEP ep\<rbrace> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od \<lbrace>\<lambda>rv. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. bl \<Longrightarrow> \<lbrace>?P'4862\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t \<lbrace>\<lambda>rv s. valid_ep' (Structures_H.endpoint.SendEP [t]) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (Structures_H.endpoint.SendEP [t]))) \<and> (if_live_then_nonz_cap' s \<and> (Structures_H.endpoint.SendEP [t] \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' ep s)) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>s. \<lbrakk>bl; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' Structures_H.endpoint.IdleEP ep) s\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call)) s \<and> ?P'4862 s
 3. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. bl \<Longrightarrow> \<lbrace>?P'4862\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t \<lbrace>\<lambda>rv s. tcb_at' t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (\<lambda>a. if a = ep then {(t, EPSend)} else state_refs_of' s a) \<and> if_live_then_nonz_cap' s \<and> ex_nonz_cap_to' ep s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>s. \<lbrakk>bl; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' Structures_H.endpoint.IdleEP ep) s\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call)) s \<and> ?P'4862 s
 3. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>bl; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' Structures_H.endpoint.IdleEP ep) s\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call)) s \<and> tcb_at' t s \<and> ((\<not> runnable' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) \<longrightarrow> sch_act_not t s) \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (Invariants_H.valid_queues s \<and> ((\<exists>p. t \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call))) \<and> sym_refs (\<lambda>a. if a = ep then {(t, EPSend)} else ((state_refs_of' s)(t := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) \<union> {r \<in> state_refs_of' s t. snd r = TCBBound})) a) \<and> (if_live_then_nonz_cap' s \<and> (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.BlockedOnSend ep ba cg cgr call \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> ex_nonz_cap_to' t s)) \<and> ex_nonz_cap_to' ep s \<and> if_unsafe_then_cap' s \<and> (valid_idle' and valid_pspace' and (\<lambda>s. t = ksIdleThread s \<longrightarrow> idle' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call))) s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s
 2. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s\<rbrakk> \<Longrightarrow> ep_at' ep s \<and> sym_refs (\<lambda>a. if a = ep then {(t, EPSend)} else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPSend)} else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s; ep \<noteq> t\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPSend)} else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ep \<noteq> t; state_refs_of' s ep = refs_of' (injectKOS Structures_H.endpoint.IdleEP); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then {(t, EPSend)} else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s x y tp. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ep \<noteq> t; state_refs_of' s ep = refs_of' (injectKOS Structures_H.endpoint.IdleEP); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; (y, tp) \<in> (if x = ep then {(t, EPSend)} else if x = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = ep then {(t, EPSend)} else if y = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s y)
 2. \<And>s x y tp. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ep \<noteq> t; state_refs_of' s ep = refs_of' (injectKOS Structures_H.endpoint.IdleEP); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ep then {(t, EPSend)} else if x = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then {(t, EPSend)} else if y = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s y)
 3. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ep \<noteq> t; state_refs_of' s ep = refs_of' (injectKOS Structures_H.endpoint.IdleEP); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 4. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s\<rbrakk> \<Longrightarrow> ep \<noteq> t
 5. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 6. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ep \<noteq> t; state_refs_of' s ep = refs_of' (injectKOS Structures_H.endpoint.IdleEP); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 2. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s\<rbrakk> \<Longrightarrow> ep \<noteq> t
 3. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 4. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' Structures_H.endpoint.IdleEP ep s\<rbrakk> \<Longrightarrow> ep \<noteq> t
 2. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 3. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>epa. \<lbrakk>epa = Structures_H.endpoint.IdleEP; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<not> bl \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' Structures_H.endpoint.IdleEP ep\<rbrace> return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<not> bl; (invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' Structures_H.endpoint.IdleEP ep) s\<rbrakk> \<Longrightarrow> invs' s
 2. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>epa x3. epa = Structures_H.endpoint.SendEP x3 \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace>
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; bl\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.SendEP x3) ep\<rbrace> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (x3 @ [t]))
od \<lbrace>\<lambda>rv. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; bl\<rbrakk> \<Longrightarrow> \<lbrace>?P'5114 epa x3\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t \<lbrace>\<lambda>rv s. valid_ep' (Structures_H.endpoint.SendEP (x3 @ [t])) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs ((state_refs_of' s)(ep := ep_q_refs_of' (Structures_H.endpoint.SendEP (x3 @ [t])))) \<and> (if_live_then_nonz_cap' s \<and> (Structures_H.endpoint.SendEP (x3 @ [t]) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' ep s)) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>epa x3 s. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; bl; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.SendEP x3) ep) s\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call)) s \<and> ?P'5114 epa x3 s
 3. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; bl\<rbrakk> \<Longrightarrow> \<lbrace>?P'5114 (Structures_H.endpoint.SendEP x3) x3\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t \<lbrace>\<lambda>rv s. tcb_at' t s \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else state_refs_of' s a) \<and> if_live_then_nonz_cap' s \<and> ex_nonz_cap_to' ep s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>epa x3 s. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; bl; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.SendEP x3) ep) s\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call)) s \<and> ?P'5114 epa x3 s
 3. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>epa x3 s. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; bl; ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' (Structures_H.endpoint.SendEP x3) ep) s\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call)) s \<and> tcb_at' t s \<and> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> ((\<not> runnable' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) \<longrightarrow> sch_act_not t s) \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (Invariants_H.valid_queues s \<and> ((\<exists>p. t \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call))) \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(t := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) \<union> {r \<in> state_refs_of' s t. snd r = TCBBound})) a) \<and> (if_live_then_nonz_cap' s \<and> (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.BlockedOnSend ep ba cg cgr call \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> ex_nonz_cap_to' t s)) \<and> ex_nonz_cap_to' ep s \<and> if_unsafe_then_cap' s \<and> (valid_idle' and valid_pspace' and (\<lambda>s. t = ksIdleThread s \<longrightarrow> idle' (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call))) s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s\<rbrakk> \<Longrightarrow> ep_at' ep s \<and> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; \<exists>k. k = Structures_H.endpoint.SendEP x3 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; \<exists>k. k = Structures_H.endpoint.SendEP x3 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s ep = refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)). ko_wp_at' (\<lambda>ko. (ep, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; \<exists>k. k = Structures_H.endpoint.SendEP x3 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s ep = refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)). ko_wp_at' (\<lambda>ko. (ep, symreftype tp) \<in> refs_of' ko) x s); tcb_at' t s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; \<exists>k. k = Structures_H.endpoint.SendEP x3 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s ep = refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)). ko_wp_at' (\<lambda>ko. (ep, symreftype tp) \<in> refs_of' ko) x s); tcb_at' t s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; \<exists>k. k = Structures_H.endpoint.SendEP x3 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s ep = refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP x3)). ko_wp_at' (\<lambda>ko. (ep, symreftype tp) \<in> refs_of' ko) x s); tcb_at' t s; \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x3. tcb_at' x s) \<and> distinct x3 \<and> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<notin> set x3 \<and> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; t \<in> set x3\<rbrakk> \<Longrightarrow> False
 2. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 3. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; t \<in> set x3; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) t s\<rbrakk> \<Longrightarrow> False
 2. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 3. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x3 s ts ntfnptr ntfnptra. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; insert (ep, TCBBlockedSend) (set_option ntfnptra \<times> {TCBBound}) = set_option ntfnptr \<times> {TCBBound}; t \<in> set x3; obj_at' (tcb_ntfn_is_bound' ntfnptra) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> False
 2. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 3. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if a = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>x3 s ts ntfnptr x y tp. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; (y, tp) \<in> (if x = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if x = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if y = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s y)
 2. \<And>x3 s ts ntfnptr x y tp. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if x = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if y = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s y)
 3. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 4. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bl; valid_pspace' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; valid_irq_handlers' s_; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; \<forall>a b. t \<notin> set (ksReadyQueues s_ (a, b)); sch_act_not t s_; ex_nonz_cap_to' ep s_; ex_nonz_cap_to' t s_; ko_at' (Structures_H.endpoint.SendEP x3_) ep s_; tcb_at' t s_; x3_ \<noteq> []; state_refs_of' s_ ep = set x3_ \<times> {EPSend}; \<forall>x\<in>set x3_. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s_; tcb_bound_refs' ntfnptr_ = tcb_st_refs_of' ts_ \<union> tcb_bound_refs' ntfnptr_; \<forall>t\<in>set x3_. tcb_at' t s_; distinct x3_; obj_at' (tcb_ntfn_is_bound' ntfnptr_) t s_; state_refs_of' s_ t = tcb_bound_refs' ntfnptr_; (y_, tp_) \<in> (if x_ = ep then insert (t, EPSend) (set x3_ \<times> {EPSend}) else if x_ = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr_. snd r = TCBBound} else state_refs_of' s_ x_); (y_, tp_) \<notin> state_refs_of' s_ x_\<rbrakk> \<Longrightarrow> (x_, symreftype tp_) \<in> (if y_ = ep then insert (t, EPSend) (set x3_ \<times> {EPSend}) else if y_ = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr_. snd r = TCBBound} else state_refs_of' s_ y_) proof (prove)
goal (3 subgoals):
 1. \<And>x3 s ts ntfnptr x y tp. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if x = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ep then insert (t, EPSend) (set x3 \<times> {EPSend}) else if y = t then insert (ep, TCBBlockedSend) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s y)
 2. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 3. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x3 s ts ntfnptr. \<lbrakk>bl; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); sch_act_not t s; ex_nonz_cap_to' ep s; ex_nonz_cap_to' t s; ko_at' (Structures_H.endpoint.SendEP x3) ep s; tcb_at' t s; x3 \<noteq> []; state_refs_of' s ep = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ep a b c d) x s; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 2. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>epa x3. \<lbrakk>epa = Structures_H.endpoint.SendEP x3; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>invs' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and sch_act_not t and ex_nonz_cap_to' ep and ex_nonz_cap_to' t and ko_at' epa ep\<rbrace> case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) ba cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep ba cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return () \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal:
No subgoals!