theory Syscall_DR

lemma handle_recv_corres:
  "dcorres dc \<top> (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs)
  Syscall_D.handle_recv (Syscall_A.handle_recv is_blocking)" apply (simp add: Syscall_D.handle_recv_def Syscall_A.handle_recv_def delete_caller_cap_def) apply (rule corres_guard_imp) apply (rule corres_split[OF get_cur_thread_corres]) apply (simp add:liftM_def select_f_get_register get_thread_def bind_assoc) apply (rename_tac thread) apply (rule_tac P=\<top> and P'="invs and valid_etcbs and (\<lambda>s. thread = cur_thread s
                                   \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)"
                     in dcorres_gets_the) apply (clarsimp simp: not_idle_thread_def, frule(1) valid_etcbs_get_tcb_get_etcb) apply (clarsimp simp:opt_object_tcb gets_def transform_tcb_def) apply (simp add:transform_full_intent_def Let_def cap_fault_injection) apply (rule corres_guard_imp) apply (rule corres_split_catch[where f= dc, OF _ handle_fault_corres]) apply (rule dcorres_injection_handler_rhs) apply (rule_tac R' ="\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow>
                  (ep_at ref s)) \<and> not_idle_thread (cur_thread s') s
                 \<and> not_idle_thread (cur_thread s) s
                 \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s " and R= "\<lambda>r. \<top>"
                       in corres_splitEE[where r'="\<lambda>x y. x = transform_cap y"]) apply (rule lookup_cap_corres, simp) apply (simp add: word_bits_def) apply (rule dcorres_expand_pfx) apply (clarsimp split:cap.splits arch_cap.splits split del: if_split simp:transform_cap_def) apply (rename_tac word1 word2 set) apply (rule corres_guard_imp) apply (case_tac "AllowRead \<in> set"; simp split del: if_split) apply (rule corres_alternate1) apply clarsimp apply (rule corres_split[where r'=dc]) apply (simp add: delete_caller_cap_def transform_tcb_slot_simp[symmetric]) apply (rule delete_cap_simple_corres) apply (rule_tac epptr=word1 in recv_sync_ipc_corres
                                      [where ep_cap="cap.EndpointCap _ _ _", simplified];
                          simp) apply (wp | clarsimp simp: delete_caller_cap_def not_idle_thread_def)+ apply (rule hoare_vcg_conj_lift) apply (rule_tac t1="cur_thread s'" in hoare_post_imp[OF _ cap_delete_one_st_tcb_at_and_valid_etcbs]) apply (fastforce simp: obj_at_def generates_pending_def st_tcb_at_def) apply (rule_tac Q="\<lambda>rv. invs and valid_etcbs" in hoare_strengthen_post) apply wp apply (clarsimp simp: invs_def) apply clarsimp apply (clarsimp simp: emptyable_def not_idle_thread_def) defer (* NEED RECEIVE ASYNC IPC *)
               apply clarsimp apply wp+ apply (rule hoare_vcg_conj_liftE_R) apply (rule hoare_post_imp_R, rule lookup_cap_valid) apply (clarsimp simp: valid_cap_def) apply wp+ apply (simp add:injection_handler_def) apply (wp get_simple_ko_wp |wpc)+ apply (simp only: conj_ac) apply wp apply (rule hoare_vcg_E_elim) apply (simp add: lookup_cap_def lookup_slot_for_thread_def split_def) apply wp apply (rule hoare_post_impErr[OF resolve_address_bits_valid_fault]) apply simp apply simp apply wp apply (rule validE_validE_R) apply (clarsimp simp:validE_def) apply (rule_tac Q = "\<lambda>r s. cur_thread s = cur_thread s' \<and>
                                not_idle_thread (cur_thread s) s \<and>
                                st_tcb_at active (cur_thread s) s \<and>
                                invs s \<and> valid_etcbs s \<and>
                                valid_irq_node s" in hoare_strengthen_post) apply wp apply (clarsimp simp add: valid_fault_def) apply clarsimp+ apply (clarsimp dest!: get_tcb_SomeD
                         simp: invs_valid_tcb_ctable valid_state_def invs_def
                               obj_at_def valid_pspace_def not_idle_thread_def) apply (clarsimp, frule(1) valid_etcbs_get_tcb_get_etcb) apply (clarsimp simp:opt_object_tcb not_idle_thread_def) apply wp+ apply simp apply (clarsimp simp:emptyable_def not_idle_thread_def) apply (clarsimp simp: liftE_bindE get_simple_ko_def get_object_def gets_def bind_assoc) apply (rule dcorres_absorb_get_r) apply (clarsimp simp: assert_def corres_free_fail partial_inv_def a_type_def
                 split: Structures_A.kernel_object.splits) apply safe[1] apply (rule corres_alternate1, clarsimp, rule corres_guard_imp[OF recv_signal_corres], (clarsimp simp: transform_cap_def)+)+ apply (rule corres_alternate2) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) Syscall_D.handle_recv (Syscall_A.handle_recv is_blocking) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) (do tcb_id <- gets_the cdl_current_thread;
tcb <- get_thread tcb_id;
doE ep_cap <- CSpace_D.lookup_cap tcb_id (cdl_intent_cap (cdl_tcb_intent tcb));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (tcb_id, tcb_caller_slot);
Endpoint_D.receive_ipc tcb_id (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal tcb_id ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)
od) (do thread <- gets cur_thread;
ep_cptr <- liftM to_bl (as_user thread (getRegister cap_register));
cap_fault_on_failure (of_bl ep_cptr) True (doE ep_cap <- CSpace_A.lookup_cap thread ep_cptr;
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap thread;
Ipc_A.receive_ipc thread ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some thread \<or> boundTCB = None then liftE $ receive_signal thread ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault thread
od) proof (prove)
goal (3 subgoals):
 1. dcorres dc ?Q ?Q' (do tcb_id <- gets_the cdl_current_thread;
tcb <- get_thread tcb_id;
doE ep_cap <- CSpace_D.lookup_cap tcb_id (cdl_intent_cap (cdl_tcb_intent tcb));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (tcb_id, tcb_caller_slot);
Endpoint_D.receive_ipc tcb_id (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal tcb_id ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)
od) (do thread <- gets cur_thread;
ep_cptr <- liftM to_bl (as_user thread (getRegister cap_register));
cap_fault_on_failure (of_bl ep_cptr) True (doE ep_cap <- CSpace_A.lookup_cap thread ep_cptr;
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap thread;
Ipc_A.receive_ipc thread ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some thread \<or> boundTCB = None then liftE $ receive_signal thread ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault thread
od)
 2. \<And>s. True \<Longrightarrow> ?Q s
 3. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ?Q' s proof (prove)
goal (5 subgoals):
 1. \<And>tcb_id thread. tcb_id = thread \<Longrightarrow> dcorres dc (?R4 tcb_id) (?R'4 thread) (do tcb <- get_thread tcb_id;
doE ep_cap <- CSpace_D.lookup_cap tcb_id (cdl_intent_cap (cdl_tcb_intent tcb));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (tcb_id, tcb_caller_slot);
Endpoint_D.receive_ipc tcb_id (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal tcb_id ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)
od) (do ep_cptr <- liftM to_bl (as_user thread (getRegister cap_register));
cap_fault_on_failure (of_bl ep_cptr) True (doE ep_cap <- CSpace_A.lookup_cap thread ep_cptr;
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap thread;
Ipc_A.receive_ipc thread ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some thread \<or> boundTCB = None then liftE $ receive_signal thread ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault thread
od)
 2. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>?R4\<rbrace>
 3. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>?R'4\<rbrace>
 4. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 5. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (5 subgoals):
 1. \<And>tcb_id. dcorres dc (?R4 tcb_id) (?R'4 tcb_id) (do x <- KHeap_D.get_object tcb_id;
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
doE ep_cap <- CSpace_D.lookup_cap tcb_id (cdl_intent_cap (cdl_tcb_intent tcb));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (tcb_id, tcb_caller_slot);
Endpoint_D.receive_ipc tcb_id (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal tcb_id ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)
od) (do tcb <- gets_the (get_tcb tcb_id);
cap_fault_on_failure (arch_tcb_context_get (tcb_arch tcb) cap_register) True (doE ep_cap <- CSpace_A.lookup_cap tcb_id (to_bl (arch_tcb_context_get (tcb_arch tcb) cap_register));
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap tcb_id;
Ipc_A.receive_ipc tcb_id ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some tcb_id \<or> boundTCB = None then liftE $ receive_signal tcb_id ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault tcb_id
od)
 2. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>?R4\<rbrace>
 3. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>?R'4\<rbrace>
 4. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 5. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (5 subgoals):
 1. \<And>thread. dcorres dc (?R4 thread) (?R'4 thread) (do x <- KHeap_D.get_object thread;
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
doE ep_cap <- CSpace_D.lookup_cap thread (cdl_intent_cap (cdl_tcb_intent tcb));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (thread, tcb_caller_slot);
Endpoint_D.receive_ipc thread (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal thread ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)
od) (do tcb <- gets_the (get_tcb thread);
cap_fault_on_failure (arch_tcb_context_get (tcb_arch tcb) cap_register) True (doE ep_cap <- CSpace_A.lookup_cap thread (to_bl (arch_tcb_context_get (tcb_arch tcb) cap_register));
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap thread;
Ipc_A.receive_ipc thread ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some thread \<or> boundTCB = None then liftE $ receive_signal thread ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault thread
od)
 2. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>?R4\<rbrace>
 3. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>?R'4\<rbrace>
 4. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 5. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>thread s s' obj obj'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' = Some obj'; cdl_objects s thread = Some obj\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do tcb <- case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
doE ep_cap <- CSpace_D.lookup_cap thread (cdl_intent_cap (cdl_tcb_intent tcb));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (thread, tcb_caller_slot);
Endpoint_D.receive_ipc thread (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal thread ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)
od) (cap_fault_on_failure (arch_tcb_context_get (tcb_arch obj') cap_register) True (doE ep_cap <- CSpace_A.lookup_cap thread (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap thread;
Ipc_A.receive_ipc thread ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some thread \<or> boundTCB = None then liftE $ receive_signal thread ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault thread)
 2. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 3. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 5. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 6. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>s' obj obj'. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; cdl_objects (transform s') (cur_thread s') = Some obj; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; \<exists>etcb. get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do tcb <- case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (cdl_intent_cap (cdl_tcb_intent tcb));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)
od) (cap_fault_on_failure (arch_tcb_context_get (tcb_arch obj') cap_register) True (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault (cur_thread s'))
 2. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 3. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 5. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 6. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (cdl_intent_cap (transform_full_intent (machine_state s') (cur_thread s') obj'));
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)) (cap_fault_on_failure (arch_tcb_context_get (tcb_arch obj') cap_register) True (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
let flt = throwError (MissingCapability 0) in case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else flt | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else flt
odE else flt | _ \<Rightarrow> flt
odE) <catch> Ipc_A.handle_fault (cur_thread s'))
 2. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 3. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 5. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 6. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)) (injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) <catch> Ipc_A.handle_fault (cur_thread s'))
 2. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 3. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 5. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 6. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc (?Q22 s' obj' etcb) (?Q'22 s' obj' etcb) (doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE <catch> (\<lambda>_. Endpoint_D.handle_fault)) (injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) <catch> Ipc_A.handle_fault (cur_thread s'))
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ?Q22 s' obj' etcb s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> ?Q'22 s' obj' etcb s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P26 s' obj' etcb) (?P'26 s' obj' etcb) (doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE) (injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE))
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> (?P26 s' obj' etcb and ?Q26 s' obj' etcb) s
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (?P'26 s' obj' etcb and ?Q'26 s' obj' etcb) s
 6. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 7. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 9. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P26 s' obj' etcb) (?P'26 s' obj' etcb) (doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE)
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> (?P26 s' obj' etcb and ?Q26 s' obj' etcb) s
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (?P'26 s' obj' etcb and ?Q'26 s' obj' etcb) s
 6. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 7. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 9. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = transform_cap y)) (?P40 s' obj' etcb) (?P'40 s' obj' etcb) (CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register)) (CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))
 2. \<And>s' obj' etcb rv rv'. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>s. (\<forall>ref badge rights. rv' = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s) (case rv of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object rv) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') rv) \<sqinter> throw else throw | _ \<Rightarrow> throw) (case rv' of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') rv' is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') rv' is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0))
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> (?P40 s' obj' etcb and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (?P'40 s' obj' etcb and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 9. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 10. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> length (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) = word_bits
 2. \<And>s' obj' etcb rv rv'. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>s. (\<forall>ref badge rights. rv' = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s) (case rv of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object rv) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') rv) \<sqinter> throw else throw | _ \<Rightarrow> throw) (case rv' of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') rv' is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') rv' is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0))
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 9. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 10. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb rv rv'. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>s. (\<forall>ref badge rights. rv' = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s) (case rv of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object rv) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') rv) \<sqinter> throw else throw | _ \<Rightarrow> throw) (case rv' of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') rv' is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') rv' is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0))
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 8. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 9. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb rv rv' s s'a. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; rv = transform_cap rv'; s = transform s'a; True; (\<forall>ref badge rights. rv' = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s'a) \<and> not_idle_thread (cur_thread s') s'a \<and> not_idle_thread (cur_thread s'a) s'a \<and> (st_tcb_at active (cur_thread s') s'a \<and> invs s'a \<and> valid_etcbs s'a) \<and> ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s'a) (case rv of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object rv) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') rv) \<sqinter> throw else throw | _ \<Rightarrow> throw) (case rv' of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') rv' is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') rv' is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0))
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 8. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 9. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' obj' etcb s'a x31 x32 x33. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at x31 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x33 then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (cdl_cap.EndpointCap x31 x32 x33)) (AllowGrant \<in> x33)
od) \<sqinter> throw else throw) (if AllowRead \<in> x33 then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap x31 x32 x33) is_blocking
od else throwError (MissingCapability 0))
 2. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 3. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 9. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 10. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> set then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (cdl_cap.EndpointCap word1 word2 set)) (AllowGrant \<in> set)
od) \<sqinter> throw else throw) (if AllowRead \<in> set then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking
od else throwError (MissingCapability 0))
 2. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 3. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 9. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 10. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q205 s' obj' etcb s'a word1 word2 set) (?Q'205 s' obj' etcb s'a word1 word2 set) (if AllowRead \<in> set then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (cdl_cap.EndpointCap word1 word2 set)) (AllowGrant \<in> set)
od) \<sqinter> throw else throw) (if AllowRead \<in> set then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking
od else throwError (MissingCapability 0))
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q205 s' obj' etcb s'a word1 word2 set s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'205 s' obj' etcb s'a word1 word2 set s
 4. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 5. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q205 s' obj' etcb s'a word1 word2 set) (?Q'205 s' obj' etcb s'a word1 word2 set) (liftE (do y <- delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') word1 (AllowGrant \<in> set)
od) \<sqinter> throw) (liftE (do y <- delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking
od))
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q205 s' obj' etcb s'a word1 word2 set s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'205 s' obj' etcb s'a word1 word2 set s
 4. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 5. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q205 s' obj' etcb s'a word1 word2 set) (?Q'205 s' obj' etcb s'a word1 word2 set) (liftE (do y <- delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') word1 (AllowGrant \<in> set)
od)) (liftE (do y <- delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking
od))
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q205 s' obj' etcb s'a word1 word2 set s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'205 s' obj' etcb s'a word1 word2 set s
 4. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 5. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> dcorres dc (?Q205 s' obj' etcb s'a word1 word2 set) (?Q'205 s' obj' etcb s'a word1 word2 set) (do y <- delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') word1 (AllowGrant \<in> set)
od) (do y <- delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking
od)
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q205 s' obj' etcb s'a word1 word2 set s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'205 s' obj' etcb s'a word1 word2 set s
 4. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 5. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> dcorres dc (?P220 s' obj' etcb s'a word1 word2 set) (?P'220 s' obj' etcb s'a word1 word2 set) (delete_cap_simple (cur_thread s', tcb_caller_slot)) (delete_caller_cap (cur_thread s'))
 2. \<And>s' obj' etcb s'a word1 word2 set y ya. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set; dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R220 s' obj' etcb s'a word1 word2 set y) (?R'220 s' obj' etcb s'a word1 word2 set ya) (Endpoint_D.receive_ipc (cur_thread s') word1 (AllowGrant \<in> set)) (Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking)
 3. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_cap_simple (cur_thread s', tcb_caller_slot) \<lbrace>?R220 s' obj' etcb s'a word1 word2 set\<rbrace>
 4. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_caller_cap (cur_thread s') \<lbrace>?R'220 s' obj' etcb s'a word1 word2 set\<rbrace>
 5. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> (?P220 s' obj' etcb s'a word1 word2 set and ?Q220 s' obj' etcb s'a word1 word2 set) s
 6. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (?P'220 s' obj' etcb s'a word1 word2 set and ?Q'220 s' obj' etcb s'a word1 word2 set) s
 7. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 8. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> dcorres dc (?P220 s' obj' etcb s'a word1 word2 set) (?P'220 s' obj' etcb s'a word1 word2 set) (delete_cap_simple (transform_cslot_ptr (cur_thread s', tcb_cnode_index 3))) (cap_delete_one (cur_thread s', tcb_cnode_index 3))
 2. \<And>s' obj' etcb s'a word1 word2 set y ya. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set; dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R220 s' obj' etcb s'a word1 word2 set y) (?R'220 s' obj' etcb s'a word1 word2 set ya) (Endpoint_D.receive_ipc (cur_thread s') word1 (AllowGrant \<in> set)) (Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking)
 3. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_cap_simple (cur_thread s', tcb_caller_slot) \<lbrace>?R220 s' obj' etcb s'a word1 word2 set\<rbrace>
 4. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_caller_cap (cur_thread s') \<lbrace>?R'220 s' obj' etcb s'a word1 word2 set\<rbrace>
 5. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> (?P220 s' obj' etcb s'a word1 word2 set and ?Q220 s' obj' etcb s'a word1 word2 set) s
 6. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (?P'220 s' obj' etcb s'a word1 word2 set and ?Q'220 s' obj' etcb s'a word1 word2 set) s
 7. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 8. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set y ya. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set; dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R220 s' obj' etcb s'a word1 word2 set y) (?R'220 s' obj' etcb s'a word1 word2 set ya) (Endpoint_D.receive_ipc (cur_thread s') word1 (AllowGrant \<in> set)) (Ipc_A.receive_ipc (cur_thread s') (cap.EndpointCap word1 word2 set) is_blocking)
 2. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_cap_simple (cur_thread s', tcb_caller_slot) \<lbrace>?R220 s' obj' etcb s'a word1 word2 set\<rbrace>
 3. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_caller_cap (cur_thread s') \<lbrace>?R'220 s' obj' etcb s'a word1 word2 set\<rbrace>
 4. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q220 s' obj' etcb s'a word1 word2 set) s
 5. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and ?Q'220 s' obj' etcb s'a word1 word2 set) s
 6. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 7. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_cap_simple (cur_thread s', tcb_caller_slot) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?Q'220 s' obj' etcb s'a word1 word2 set\<rbrace> delete_caller_cap (cur_thread s') \<lbrace>\<lambda>ya. ep_at word1 and not_idle_thread (cur_thread s') and (\<lambda>s. not_idle_thread (cur_thread s) s) and st_tcb_at active (cur_thread s') and valid_state and valid_etcbs\<rbrace>
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q220 s' obj' etcb s'a word1 word2 set) s
 4. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and ?Q'220 s' obj' etcb s'a word1 word2 set) s
 5. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 6. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?P'258 s' obj' etcb s'a word1 word2 set\<rbrace> cap_delete_one (cur_thread s', tcb_cnode_index 3) \<lbrace>\<lambda>rv s. st_tcb_at active (cur_thread s') s \<and> valid_state s \<and> valid_etcbs s\<rbrace>
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> ?P'258 s' obj' etcb s'a word1 word2 set s)) s
 4. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 5. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?P261 s' obj' etcb s'a word1 word2 set\<rbrace> cap_delete_one (cur_thread s', tcb_cnode_index 3) \<lbrace>\<lambda>rv. st_tcb_at active (cur_thread s')\<rbrace>
 2. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?P'261 s' obj' etcb s'a word1 word2 set\<rbrace> cap_delete_one (cur_thread s', tcb_cnode_index 3) \<lbrace>\<lambda>rv s. valid_state s \<and> valid_etcbs s\<rbrace>
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 4. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> ?P261 s' obj' etcb s'a word1 word2 set s \<and> ?P'261 s' obj' etcb s'a word1 word2 set s)) s
 5. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 6. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set rv s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set; st_tcb_at (?P265 s' obj' etcb s'a word1 word2 set) (cur_thread s') s \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> st_tcb_at active (cur_thread s') s
 2. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?P'261 s' obj' etcb s'a word1 word2 set\<rbrace> cap_delete_one (cur_thread s', tcb_cnode_index 3) \<lbrace>\<lambda>rv s. valid_state s \<and> valid_etcbs s\<rbrace>
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 4. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> (st_tcb_at (?P265 s' obj' etcb s'a word1 word2 set) (cur_thread s') and K (\<forall>st. active st \<longrightarrow> ?P265 s' obj' etcb s'a word1 word2 set st) and valid_etcbs) s \<and> ?P'261 s' obj' etcb s'a word1 word2 set s)) s
 5. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 6. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?P'261 s' obj' etcb s'a word1 word2 set\<rbrace> cap_delete_one (cur_thread s', tcb_cnode_index 3) \<lbrace>\<lambda>rv s. valid_state s \<and> valid_etcbs s\<rbrace>
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> (st_tcb_at active (cur_thread s') and K (\<forall>st. active st \<longrightarrow> active st) and valid_etcbs) s \<and> ?P'261 s' obj' etcb s'a word1 word2 set s)) s
 4. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 5. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set\<rbrakk> \<Longrightarrow> \<lbrace>?P'261 s' obj' etcb s'a word1 word2 set\<rbrace> cap_delete_one (cur_thread s', tcb_cnode_index 3) \<lbrace>\<lambda>rv. invs and valid_etcbs\<rbrace>
 2. \<And>s' obj' etcb s'a word1 word2 set rv s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set; (invs and valid_etcbs) s\<rbrakk> \<Longrightarrow> valid_state s \<and> valid_etcbs s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 4. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> (st_tcb_at active (cur_thread s') and K (\<forall>st. active st \<longrightarrow> active st) and valid_etcbs) s \<and> ?P'261 s' obj' etcb s'a word1 word2 set s)) s
 5. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 6. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set rv s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; cur_thread s' \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> set; (invs and valid_etcbs) s\<rbrakk> \<Longrightarrow> valid_state s \<and> valid_etcbs s
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 3. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> (st_tcb_at active (cur_thread s') and K (\<forall>st. active st \<longrightarrow> active st) and valid_etcbs) s \<and> (invs and emptyable (cur_thread s', tcb_cnode_index 3)) s \<and> valid_etcbs s)) s
 4. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 5. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 2. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> (st_tcb_at active (cur_thread s') and K (\<forall>st. active st \<longrightarrow> active st) and valid_etcbs) s \<and> (invs and emptyable (cur_thread s', tcb_cnode_index 3)) s \<and> valid_etcbs s)) s
 3. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 4. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 9. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 10. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' obj' etcb s'a word1 word2 set s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; ep_at word1 s'a; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; s'a = s\<rbrakk> \<Longrightarrow> (invs and not_idle_thread (fst (cur_thread s', tcb_cnode_index 3)) and valid_etcbs and (\<lambda>s. ep_at word1 s \<and> cur_thread s' \<noteq> idle_thread s \<and> cur_thread s \<noteq> idle_thread s \<and> (st_tcb_at active (cur_thread s') and K (\<forall>st. active st \<longrightarrow> active st) and valid_etcbs) s \<and> (invs and emptyable (cur_thread s', tcb_cnode_index 3)) s \<and> valid_etcbs s)) s
 2. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 3. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 9. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 10. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0))
 2. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 9. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 10. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 8. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 9. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb s'a x51 x52 x53. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (case if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53 of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') (if x52 then MasterReplyCap x51 else cdl_cap.ReplyCap x51 x53)) \<sqinter> throw else throw | _ \<Rightarrow> throw) (throwError (MissingCapability 0))
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 8. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 9. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 s' obj' etcb\<rbrace> CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register) \<lbrace>\<lambda>r _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 s' obj' etcb and ?Q26 s' obj' etcb) s
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and ?Q'40 s' obj' etcb and ?Q'26 s' obj' etcb) s
 7. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 8. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 10. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'288 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. (\<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s) \<and> not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, -
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and ?Q26 s' obj' etcb) s
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> ?P'288 s' obj' etcb s) and ?Q'26 s' obj' etcb) s
 6. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 7. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 9. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P291 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. \<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s\<rbrace>, -
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, -
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and ?Q26 s' obj' etcb) s
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (?P291 s' obj' etcb and ?Q291 s' obj' etcb) s) and ?Q'26 s' obj' etcb) s
 7. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 8. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 10. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb rv s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s \<turnstile> rv\<rbrakk> \<Longrightarrow> \<forall>ref badge rights. rv = cap.EndpointCap ref badge rights \<longrightarrow> ep_at ref s
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, -
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and ?Q26 s' obj' etcb) s
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and ?Q291 s' obj' etcb) s) and ?Q'26 s' obj' etcb) s
 7. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 8. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 10. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>rv s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s\<rbrace>, -
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_D.lookup_cap (cur_thread s') (arch_tcb_context_get (tcb_arch obj') cap_register);
case ep_cap of cdl_cap.EndpointCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ do delete_cap_simple (cur_thread s', tcb_caller_slot);
Endpoint_D.receive_ipc (cur_thread s') (cap_object ep_cap) (AllowGrant \<in> rights)
od) \<sqinter> throw else throw | cdl_cap.NotificationCap o_id badge rights \<Rightarrow> if AllowRead \<in> rights then (liftE $ recv_signal (cur_thread s') ep_cap) \<sqinter> throw else throw | _ \<Rightarrow> throw
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and ?Q26 s' obj' etcb) s
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and ?Q291 s' obj' etcb) s) and ?Q'26 s' obj' etcb) s
 6. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 7. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 9. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> injection_handler (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True) (doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and ?Q'26 s' obj' etcb) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s' obj' etcb\<rbrace> doE ep_cap <- CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register));
case ep_cap of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then liftE $ do delete_caller_cap (cur_thread s');
Ipc_A.receive_ipc (cur_thread s') ep_cap is_blocking
od else throwError (MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRecv \<in> rights then doE ntfn <- liftE $ get_notification ref;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') ep_cap is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0) | _ \<Rightarrow> throwError (MissingCapability 0)
odE <handle2> (\<lambda>ft. throwError (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True ft)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault ft' \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s\<rbrace>
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and ?Q'26 s' obj' etcb) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'853 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.NullCap \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True))) \<and> (AllowRecv \<notin> xb \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True)) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (ep_cap = cap.DomainCap \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (ep_cap = IRQControlCap \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv) \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> True\<rbrace>
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> ?P'853 s' obj' etcb s)) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'853 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, \<lbrace>\<lambda>rv s. True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> ?P'853 s' obj' etcb s)) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'863 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> ?P'863 s' obj' etcb s)) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) -, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, -
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> ?P866 s' obj' etcb s \<and> ?P'866 s' obj' etcb s)) s
 5. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 6. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 8. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 9. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 10. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P866 s' obj' etcb\<rbrace> doE p <- doE tcb <- liftE (gets_the (get_tcb (cur_thread s')));
CSpace_A.resolve_address_bits (tcb_ctable tcb, to_bl (arch_tcb_context_get (tcb_arch obj') cap_register))
odE;
liftE (CSpaceAcc_A.get_cap (fst p))
odE -, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, -
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> ?P866 s' obj' etcb s \<and> ?P'866 s' obj' etcb s)) s
 5. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 6. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 8. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 9. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 10. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (11 subgoals):
 1. \<And>s' obj' etcb tcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?B874 s' obj' etcb tcb\<rbrace> CSpace_A.resolve_address_bits (tcb_ctable tcb, to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>p _. True\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P866 s' obj' etcb\<rbrace> liftE (gets_the (get_tcb (cur_thread s'))) \<lbrace>?B874 s' obj' etcb\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, -
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> ?P866 s' obj' etcb s \<and> ?P'866 s' obj' etcb s)) s
 6. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 7. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 9. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb tcb rv s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; valid_objs s\<rbrakk> \<Longrightarrow> True
 2. \<And>s' obj' etcb tcb e s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; valid_fault (CapFault (?x877 s' obj' etcb tcb) (?y877 s' obj' etcb tcb) e)\<rbrakk> \<Longrightarrow> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True e)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P866 s' obj' etcb\<rbrace> liftE (gets_the (get_tcb (cur_thread s'))) \<lbrace>\<lambda>tcb. valid_objs and valid_cap (fst (tcb_ctable tcb, to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, -
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> ?P866 s' obj' etcb s \<and> ?P'866 s' obj' etcb s)) s
 7. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 8. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 10. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' obj' etcb tcb e s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; valid_fault (CapFault (?x877 s' obj' etcb tcb) (?y877 s' obj' etcb tcb) e)\<rbrakk> \<Longrightarrow> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True e)
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P866 s' obj' etcb\<rbrace> liftE (gets_the (get_tcb (cur_thread s'))) \<lbrace>\<lambda>tcb. valid_objs and valid_cap (fst (tcb_ctable tcb, to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, -
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> ?P866 s' obj' etcb s \<and> ?P'866 s' obj' etcb s)) s
 6. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 7. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 9. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P866 s' obj' etcb\<rbrace> liftE (gets_the (get_tcb (cur_thread s'))) \<lbrace>\<lambda>tcb. valid_objs and valid_cap (fst (tcb_ctable tcb, to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True rv)\<rbrace>
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, -
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> ?P866 s' obj' etcb s \<and> ?P'866 s' obj' etcb s)) s
 5. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 6. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 8. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 9. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 10. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, -
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> (get_tcb (cur_thread s') s \<noteq> None \<longrightarrow> (valid_objs and valid_cap (fst (tcb_ctable (the (get_tcb (cur_thread s') s)), to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))) s) \<and> ?P'866 s' obj' etcb s)) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>ep_cap s. (ep_cap = cap.DomainCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = IRQControlCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (ep_cap = cap.NullCap \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ThreadCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = IRQHandlerCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x. ep_cap = ArchObjectCap x \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.CNodeCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.ReplyCap x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = Zombie x xa xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb xc. ep_cap = cap.UntypedCap x xa xb xc \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. ep_cap = cap.EndpointCap x xa xb \<longrightarrow> (AllowRecv \<in> xb \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)) \<and> (\<forall>x xa xb. ep_cap = cap.NotificationCap x xa xb \<longrightarrow> (AllowRecv \<notin> xb \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRecv \<in> xb \<longrightarrow> True \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True) \<and> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True) \<and> (\<not> (ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None) \<longrightarrow> True \<and> True \<and> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> (get_tcb (cur_thread s') s \<noteq> None \<longrightarrow> (valid_objs and valid_cap (fst (tcb_ctable (the (get_tcb (cur_thread s') s)), to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))) s) \<and> ?P'866 s' obj' etcb s)) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>v s. \<forall>r. v = Inr r \<longrightarrow> (r = cap.DomainCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (r = IRQControlCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (r = cap.NullCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = ThreadCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = IRQHandlerCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = ArchObjectCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = cap.CNodeCap x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = cap.ReplyCap x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = Zombie x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb xc. r = cap.UntypedCap x xa xb xc) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. r = cap.EndpointCap x xa xb \<longrightarrow> AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. r = cap.NotificationCap x xa xb \<longrightarrow> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some (cur_thread s') \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)))\<rbrace>
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> (get_tcb (cur_thread s') s \<noteq> None \<longrightarrow> (valid_objs and valid_cap (fst (tcb_ctable (the (get_tcb (cur_thread s') s)), to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))) s) \<and> ?P'866 s' obj' etcb s)) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'866 s' obj' etcb\<rbrace> CSpace_A.lookup_cap (cur_thread s') (to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)) \<lbrace>\<lambda>r s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s \<and> invs s \<and> valid_etcbs s \<and> valid_irq_node s\<rbrace>
 2. \<And>s' obj' etcb rv s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s \<and> invs s \<and> valid_etcbs s \<and> valid_irq_node s\<rbrakk> \<Longrightarrow> \<forall>r. rv = Inr r \<longrightarrow> (r = cap.DomainCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (r = IRQControlCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (r = cap.NullCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = ThreadCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = IRQHandlerCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = ArchObjectCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = cap.CNodeCap x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = cap.ReplyCap x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = Zombie x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb xc. r = cap.UntypedCap x xa xb xc) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. r = cap.EndpointCap x xa xb \<longrightarrow> AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. r = cap.NotificationCap x xa xb \<longrightarrow> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some (cur_thread s') \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)))
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> (get_tcb (cur_thread s') s \<noteq> None \<longrightarrow> (valid_objs and valid_cap (fst (tcb_ctable (the (get_tcb (cur_thread s') s)), to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))) s) \<and> ?P'866 s' obj' etcb s)) s
 5. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 6. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 8. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 9. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 10. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb rv s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s \<and> invs s \<and> valid_etcbs s \<and> valid_irq_node s\<rbrakk> \<Longrightarrow> \<forall>r. rv = Inr r \<longrightarrow> (r = cap.DomainCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (r = IRQControlCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (r = cap.NullCap \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = ThreadCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = IRQHandlerCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x. r = ArchObjectCap x) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = cap.CNodeCap x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = cap.ReplyCap x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb. r = Zombie x xa xb) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> ((\<exists>x xa xb xc. r = cap.UntypedCap x xa xb xc) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. r = cap.EndpointCap x xa xb \<longrightarrow> AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (\<forall>x xa xb. r = cap.NotificationCap x xa xb \<longrightarrow> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s) \<and> (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (kernel_object.Notification ntfn) x s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some (cur_thread s') \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_irq_node s \<and> not_idle_thread (cur_thread s') s \<and> cur_thread s = cur_thread s' \<and> valid_etcbs s \<and> valid_fault (CapFault (arch_tcb_context_get (tcb_arch obj') cap_register) True (MissingCapability 0)) \<and> st_tcb_at active (cur_thread s') s)))
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> (get_tcb (cur_thread s') s \<noteq> None \<longrightarrow> (valid_objs and valid_cap (fst (tcb_ctable (the (get_tcb (cur_thread s') s)), to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))) s) \<and> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s \<and> invs s \<and> valid_etcbs s \<and> valid_irq_node s)) s
 4. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 5. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 7. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 9. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (8 subgoals):
 1. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True) and (\<lambda>s. True \<and> True)) s
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; s' = s\<rbrakk> \<Longrightarrow> (valid_global_refs and valid_objs and valid_irq_node and valid_idle and not_idle_thread (cur_thread s') and valid_etcbs and (\<lambda>s. True \<and> (valid_objs and (\<lambda>s. not_idle_thread (cur_thread s') s \<and> not_idle_thread (cur_thread s) s \<and> (st_tcb_at active (cur_thread s') s \<and> invs s \<and> valid_etcbs s) \<and> ko_at (TCB obj') (cur_thread s') s)) s) and (\<lambda>s. cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s') s \<and> st_tcb_at active (cur_thread s') s \<and> True \<and> invs s \<and> valid_irq_node s \<and> valid_etcbs s \<and> (get_tcb (cur_thread s') s \<noteq> None \<longrightarrow> (valid_objs and valid_cap (fst (tcb_ctable (the (get_tcb (cur_thread s') s)), to_bl (arch_tcb_context_get (tcb_arch obj') cap_register)))) s) \<and> cur_thread s = cur_thread s' \<and> not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s \<and> invs s \<and> valid_etcbs s \<and> valid_irq_node s)) s
 3. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 4. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 5. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 6. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 7. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 8. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (7 subgoals):
 1. \<And>obj' etcb s. \<lbrakk>get_tcb (cur_thread s) s = Some obj'; invs s; valid_etcbs s; cur_thread s \<noteq> idle_thread s; st_tcb_at active (cur_thread s) s; get_etcb (cur_thread s) s = Some etcb\<rbrakk> \<Longrightarrow> valid_global_refs s \<and> valid_objs s \<and> valid_irq_node s \<and> valid_idle s \<and> not_idle_thread (cur_thread s) s \<and> valid_objs s \<and> not_idle_thread (cur_thread s) s \<and> ko_at (TCB obj') (cur_thread s) s \<and> not_idle_thread (cur_thread s) s \<and> valid_irq_node s \<and> valid_objs s \<and> s \<turnstile> tcb_ctable obj' \<and> not_idle_thread (cur_thread s) s \<and> valid_irq_node s
 2. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 3. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 5. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 6. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 7. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (6 subgoals):
 1. \<And>thread s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None
 2. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 3. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 4. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 5. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 6. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (6 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb (cur_thread s') s' = Some y; invs s'; valid_etcbs s'; not_idle_thread (cur_thread s') s'; st_tcb_at active (cur_thread s') s'; \<exists>etcb. get_etcb (cur_thread s') s' = Some etcb\<rbrakk> \<Longrightarrow> \<exists>y. cdl_objects (transform s') (cur_thread s') = Some y
 2. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 3. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 4. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 5. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 6. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (5 subgoals):
 1. \<lbrace>?Q4\<rbrace> gets_the cdl_current_thread \<lbrace>\<lambda>thread _. True\<rbrace>
 2. \<lbrace>?Q'4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. invs and valid_etcbs and (\<lambda>s. thread = cur_thread s \<and> not_idle_thread thread s \<and> st_tcb_at active thread s)\<rbrace>
 3. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 4. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and ?Q'4) s
 5. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (3 subgoals):
 1. \<And>s. True \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cdl_current_thread s \<noteq> None \<longrightarrow> True)) s
 2. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and (\<lambda>s. (invs and valid_etcbs and (\<lambda>sa. cur_thread s = cur_thread sa \<and> not_idle_thread (cur_thread s) sa \<and> st_tcb_at active (cur_thread s) sa)) s)) s
 3. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (2 subgoals):
 1. \<And>s. (invs and (\<lambda>s. not_idle_thread (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s) and valid_etcbs) s \<Longrightarrow> ((\<lambda>s. not_idle_thread (cur_thread s) s) and (\<lambda>s. (invs and valid_etcbs and (\<lambda>sa. cur_thread s = cur_thread sa \<and> not_idle_thread (cur_thread s) sa \<and> st_tcb_at active (cur_thread s) sa)) s)) s
 2. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (1 subgoal):
 1. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (if AllowRead \<in> x43 then (liftE $ recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw else throw) (if AllowRead \<in> x43 then doE ntfn <- liftE $ get_notification x41;
boundTCB <- returnOk $ ntfn_bound_tcb ntfn;
if boundTCB = Some (cur_thread s') \<or> boundTCB = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
odE else throwError (MissingCapability 0)) proof (prove)
goal (1 subgoal):
 1. \<And>s' obj' etcb s'a x41 x42 x43. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> x43\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'a)) ((=) s'a) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (do x <- get;
xa <- assert (\<exists>y. kheap x x41 = Some y);
xa <- assert (a_type (the (kheap x x41)) = AEndpoint \<or> a_type (the (kheap x x41)) = ANTFN);
ntfn <- case partial_inv kernel_object.Notification (the (kheap x x41)) of None \<Rightarrow> fail | Some x \<Rightarrow> return x;
if ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' obj' etcb s'a x41 x42 x43 s'b. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active (cur_thread s') s'a; invs s'a; valid_etcbs s'a; ko_at (TCB obj') (cur_thread s') s'a; AllowRead \<in> x43; transform s'a = transform s'b; s'a = s'b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (do x <- assert (\<exists>y. kheap s'b x41 = Some y);
x <- assert (a_type (the (kheap s'b x41)) = AEndpoint \<or> a_type (the (kheap s'b x41)) = ANTFN);
ntfn <- case partial_inv kernel_object.Notification (the (kheap s'b x41)) of None \<Rightarrow> fail | Some x \<Rightarrow> return x;
if ntfn_bound_tcb ntfn = Some (cur_thread s') \<or> ntfn_bound_tcb ntfn = None then liftE $ receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking else throwError (MissingCapability 0)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' obj' etcb x41 x42 x43 s'b. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'b; not_idle_thread (cur_thread s'b) s'b; st_tcb_at active (cur_thread s') s'b; invs s'b; valid_etcbs s'b; ko_at (TCB obj') (cur_thread s') s'b; AllowRead \<in> x43\<rbrakk> \<Longrightarrow> ((\<exists>x3. the (kheap s'b x41) = kernel_object.Endpoint x3) \<longrightarrow> (ntfn_bound_tcb (THE y. False) = Some (cur_thread s') \<longrightarrow> (\<exists>!y. False) \<longrightarrow> (\<exists>y. kheap s'b x41 = Some y) \<longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (liftE (receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking))) \<and> (ntfn_bound_tcb (THE y. False) = None \<longrightarrow> (\<exists>!y. False) \<longrightarrow> (\<exists>y. kheap s'b x41 = Some y) \<longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (liftE (receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking))) \<and> (ntfn_bound_tcb (THE y. False) \<noteq> Some (cur_thread s') \<and> (\<exists>y. ntfn_bound_tcb (THE y. False) = Some y) \<longrightarrow> (\<exists>!y. False) \<longrightarrow> (\<exists>y. kheap s'b x41 = Some y) \<longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (throwError (MissingCapability 0)))) \<and> (\<forall>x4. the (kheap s'b x41) = kernel_object.Notification x4 \<longrightarrow> (ntfn_bound_tcb x4 = Some (cur_thread s') \<longrightarrow> (\<exists>y. kheap s'b x41 = Some y) \<longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (liftE (receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking))) \<and> (ntfn_bound_tcb x4 = None \<longrightarrow> (\<exists>y. kheap s'b x41 = Some y) \<longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (liftE (receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking))) \<and> (ntfn_bound_tcb x4 \<noteq> Some (cur_thread s') \<and> (\<exists>y. ntfn_bound_tcb x4 = Some y) \<longrightarrow> (\<exists>y. kheap s'b x41 = Some y) \<longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (throwError (MissingCapability 0)))) proof (prove)
goal (3 subgoals):
 1. \<And>s' obj' etcb x41 x42 x43 s'b x4 y. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'b; not_idle_thread (cur_thread s'b) s'b; st_tcb_at active (cur_thread s') s'b; invs s'b; valid_etcbs s'b; ko_at (TCB obj') (cur_thread s') s'b; AllowRead \<in> x43; the (kheap s'b x41) = kernel_object.Notification x4; ntfn_bound_tcb x4 = Some (cur_thread s'); kheap s'b x41 = Some y\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (liftE (receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking))
 2. \<And>s' obj' etcb x41 x42 x43 s'b x4 y. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'b; not_idle_thread (cur_thread s'b) s'b; st_tcb_at active (cur_thread s') s'b; invs s'b; valid_etcbs s'b; ko_at (TCB obj') (cur_thread s') s'b; AllowRead \<in> x43; the (kheap s'b x41) = kernel_object.Notification x4; ntfn_bound_tcb x4 = None; kheap s'b x41 = Some y\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (liftE (receive_signal (cur_thread s') (cap.NotificationCap x41 x42 x43) is_blocking))
 3. \<And>s' obj' etcb x41 x42 x43 s'b x4 y ya. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'b; not_idle_thread (cur_thread s'b) s'b; st_tcb_at active (cur_thread s') s'b; invs s'b; valid_etcbs s'b; ko_at (TCB obj') (cur_thread s') s'b; AllowRead \<in> x43; the (kheap s'b x41) = kernel_object.Notification x4; ntfn_bound_tcb x4 \<noteq> Some (cur_thread s'); ntfn_bound_tcb x4 = Some y; kheap s'b x41 = Some ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (throwError (MissingCapability 0)) proof (prove)
goal (1 subgoal):
 1. \<And>s' obj' etcb x41 x42 x43 s'b x4 y. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'b; not_idle_thread (cur_thread s'b) s'b; st_tcb_at active (cur_thread s') s'b; invs s'b; valid_etcbs s'b; ko_at (TCB obj') (cur_thread s') s'b; AllowRead \<in> x43; y \<noteq> cur_thread s'; ntfn_bound_tcb x4 = Some y; kheap s'b x41 = Some (kernel_object.Notification x4)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) (liftE (recv_signal (cur_thread s') (cdl_cap.NotificationCap x41 x42 x43)) \<sqinter> throw) (throwError (MissingCapability 0)) proof (prove)
goal (1 subgoal):
 1. \<And>s' obj' etcb x41 x42 x43 s'b x4 y. \<lbrakk>get_tcb (cur_thread s') s' = Some obj'; invs s'; valid_etcbs s'; cur_thread s' \<noteq> idle_thread s'; st_tcb_at active (cur_thread s') s'; get_etcb (cur_thread s') s' = Some etcb; not_idle_thread (cur_thread s') s'b; not_idle_thread (cur_thread s'b) s'b; st_tcb_at active (cur_thread s') s'b; invs s'b; valid_etcbs s'b; ko_at (TCB obj') (cur_thread s') s'b; AllowRead \<in> x43; y \<noteq> cur_thread s'; ntfn_bound_tcb x4 = Some y; kheap s'b x41 = Some (kernel_object.Notification x4)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s'b)) ((=) s'b) throw (throwError (MissingCapability 0)) proof (prove)
goal:
No subgoals!