theory Ipc_DR

lemma dcorres_receive_sync:
  "\<lbrakk> ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s;
        not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s;
        valid_etcbs s \<rbrakk> \<Longrightarrow>
    dcorres dc ((=) (transform s)) ((=) s)
        (receive_sync thread ep can_grant)
        (case rv of
            Structures_A.endpoint.IdleEP \<Rightarrow> (case is_blocking of
                True \<Rightarrow> do set_thread_state thread
                              (Structures_A.thread_state.BlockedOnReceive ep
                                  \<lparr>receiver_can_grant = can_grant\<rparr>);
                           set_endpoint ep (Structures_A.endpoint.RecvEP [thread])
                        od
                | False \<Rightarrow> do_nbrecv_failed_transfer thread)
          | Structures_A.endpoint.SendEP q \<Rightarrow>
                do assert (q \<noteq> []);
                   queue \<leftarrow> return $ tl q;
                   sender \<leftarrow> return $ hd q;
                   set_endpoint ep $
                     (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP
                         | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue);
                   sender_state \<leftarrow> get_thread_state sender;
                   payload \<leftarrow> case sender_state of
                       Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
                   Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload)
                        (sender_can_grant payload) thread;
                   if sender_is_call payload
                   then if sender_can_grant payload \<or> sender_can_grant_reply payload
                        then setup_caller_cap sender thread can_grant
                        else set_thread_state sender Structures_A.thread_state.Inactive
                   else do set_thread_state sender Structures_A.thread_state.Running;
                           do_extended_op (possible_switch_to sender)
                        od
                od
          | Structures_A.endpoint.RecvEP queue \<Rightarrow> (case is_blocking of
              True \<Rightarrow> do set_thread_state thread
                     (Structures_A.thread_state.BlockedOnReceive ep
                          \<lparr>receiver_can_grant = can_grant\<rparr>);
                      set_endpoint ep (Structures_A.endpoint.RecvEP (queue @ [thread]))
                   od
              | False \<Rightarrow> do_nbrecv_failed_transfer thread))" supply if_cong[cong] apply (clarsimp simp: receive_sync_def gets_def) apply (rule dcorres_absorb_get_l) apply (case_tac rv) 
    (* IdleEP *)
     apply clarsimp apply (frule_tac get_endpoint_pick) apply (simp add:obj_at_def) apply (subst ep_waiting_set_send_lift) apply (simp add:valid_state_def) apply simp apply (clarsimp simp:valid_ep_abstract_def none_is_sending_ep_def option_select_def) apply (case_tac is_blocking; simp) apply (rule corres_guard_imp) apply (rule corres_alternate1) apply (rule corres_dummy_return_l) apply (rule corres_guard_imp) apply (rule corres_split[OF set_thread_state_block_on_receive_corres corres_dummy_set_sync_ep]) apply (wp|simp)+ apply (rule corres_alternate2) apply (simp add: do_nbrecv_failed_transfer_def) apply (rule corres_guard_imp) apply (rule corrupt_tcb_intent_as_user_corres, simp, simp) apply (simp add: valid_state_def) 
    (* SendEP *)
    apply (frule get_endpoint_pick) apply (simp add:obj_at_def) apply (subst ep_waiting_set_send_lift) apply (simp add:valid_state_def) apply simp apply (clarsimp simp:option_select_def valid_ep_abstract_def) apply (rename_tac list) apply (drule_tac s = "set list" in sym) apply (rule conjI, clarsimp dest!: not_empty_list_not_empty_set) apply (clarsimp simp:neq_Nil_conv, rename_tac t ts) apply (rule_tac P1="\<top>" and P'="(=) s" and x1 = t
     in dcorres_absorb_pfx[OF select_pick_corres[OF dcorres_expand_pfx],rotated]) apply clarsimp apply clarsimp apply clarsimp apply (drule_tac x1 = t in iffD2[OF eqset_imp_iff], simp) apply (clarsimp simp:ep_waiting_set_send_def get_thread_def bind_assoc gets_the_def gets_def) apply (rename_tac tcb payload) apply (rule dcorres_absorb_get_l,clarsimp) apply (frule(1) valid_etcbs_tcb_etcb, clarsimp) apply (subst opt_object_tcb) apply (erule get_tcb_rev) apply (fastforce simp: get_etcb_def) apply (frule_tac a = t and list = "t # ts" in pending_thread_in_send_not_idle) apply ((simp add: valid_state_def insertI obj_at_def not_idle_thread_def)+)[4] apply (clarsimp simp: assert_opt_def transform_tcb_def infer_tcb_pending_op_def tcb_slots
              split del: if_split) apply (rule dcorres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule_tac F="sender_state = tcb_state tcb" in corres_gen_asm2) apply (clarsimp dest!: get_tcb_SomeD simp: dc_def[symmetric]
                    split del: if_split split: if_split_asm) apply (rule corres_guard_imp) apply (rule corres_split[OF corres_complete_ipc_transfer]) apply simp apply (rule dcorres_if_rhs) apply (rule dcorres_if_rhs) apply (simp add:dc_def[symmetric] when_def) apply (rule corres_alternate1)+ apply (rule corres_setup_caller_cap) apply (clarsimp simp:st_tcb_at_def obj_at_def generates_pending_def) apply (rule corres_alternate2[OF set_thread_state_corres[unfolded tcb_slots]]) apply (rule corres_alternate1[OF corres_alternate2]) apply (rule dcorres_rhs_noop_below_True[OF possible_switch_to_dcorres]) apply (rule set_thread_state_corres[unfolded tcb_slots]) apply wp apply (wp hoare_drop_imps gts_st_tcb_at | simp add:not_idle_thread_def)+ apply (rule_tac Q="\<lambda>fault. valid_mdb and valid_objs and pspace_aligned
           and pspace_distinct and not_idle_thread t and not_idle_thread thread
           and valid_idle and valid_irq_node and (\<lambda>s. cur_thread s \<noteq> idle_thread s)
           and tcb_at t and tcb_at thread
           and st_tcb_at (\<lambda>rv. rv = Structures_A.thread_state.BlockedOnSend ep payload) t and valid_etcbs"
         in hoare_strengthen_post[rotated]) apply (clarsimp simp:not_idle_thread_def) apply (clarsimp simp:st_tcb_at_def obj_at_def) apply ((wp | clarsimp simp:not_idle_thread_def | wps )+)[1] apply (frule_tac a = t and list = "t # ts" in pending_thread_in_send_not_idle) apply (clarsimp simp:valid_state_def insertI)+ apply (simp add:obj_at_def not_idle_thread_def)+ apply (clarsimp simp:valid_state_def st_tcb_at_def obj_at_def valid_pspace_def) apply (drule valid_objs_valid_ep_simp) apply (simp add:is_ep_def) apply (clarsimp simp:valid_ep_def a_type_def
                     split:Structures_A.endpoint.splits list.splits) apply (clarsimp simp:valid_state_def valid_pspace_def a_type_def)+ apply (rule dcorres_to_wp[where Q=\<top>,simplified]) apply (rule corres_dummy_set_sync_ep) 
  (* RecvEP *)
   apply clarsimp apply (frule get_endpoint_pick) apply (simp add:obj_at_def) apply (subst ep_waiting_set_send_lift) apply (simp add:valid_state_def) apply simp apply (clarsimp simp:valid_ep_abstract_def none_is_sending_ep_def option_select_def) apply (case_tac is_blocking; simp) apply (rule corres_guard_imp) apply (rule corres_alternate1) apply (rule corres_dummy_return_l) apply (rule corres_guard_imp) apply (rule corres_split[OF set_thread_state_block_on_receive_corres corres_dummy_set_sync_ep]) apply (wp|simp)+ apply (simp add: do_nbrecv_failed_transfer_def) apply (rule corres_alternate2) apply (rule corres_guard_imp) apply (rule corrupt_tcb_intent_as_user_corres, (simp add: valid_state_def)+) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (receive_sync thread ep can_grant) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (receive_sync thread ep can_grant) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (do s <- get;
option_select (get_waiting_sync_send_threads ep s) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)
od) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = IdleEP\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = IdleEP\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (get_waiting_sync_send_threads ep (transform s)) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP\<rbrakk> \<Longrightarrow> kheap s ?epptr6 = Some (kernel_object.Endpoint ?endpoint6)
 2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract ?endpoint6 ?epptr6 s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (get_waiting_sync_send_threads ep (transform s)) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract IdleEP ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (get_waiting_sync_send_threads ep (transform s)) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract IdleEP ep s\<rbrakk> \<Longrightarrow> valid_idle s
 2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract IdleEP ep s\<rbrakk> \<Longrightarrow> valid_etcbs s
 3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract IdleEP ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (ep_waiting_set_send ep s) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 4. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 5. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract IdleEP ep s\<rbrakk> \<Longrightarrow> valid_etcbs s
 2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract IdleEP ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (ep_waiting_set_send ep s) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; valid_ep_abstract IdleEP ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (ep_waiting_set_send ep s) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od)
 2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 3. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ?Q20 ?Q'20 (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od)
 2. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q20 sa
 3. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'20 sa
 4. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 5. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 6. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ?Q20 ?Q'20 (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant)) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od)
 2. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q20 sa
 3. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'20 sa
 4. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 5. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 6. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ?Q20 ?Q'20 (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) >>= return) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od)
 2. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q20 sa
 3. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'20 sa
 4. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 5. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 6. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ?Q28 ?Q'28 (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) >>= return) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od)
 2. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; ?Q20 sa\<rbrakk> \<Longrightarrow> ?Q28 sa
 3. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; ?Q'20 sa\<rbrakk> \<Longrightarrow> ?Q'28 sa
 4. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q20 sa
 5. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'20 sa
 6. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 7. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 8. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q32\<rbrace> block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32\<rbrace> set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; ?Q20 sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q32) sa
 4. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; ?Q'20 sa\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'32) sa
 5. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q20 sa
 6. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'20 sa
 7. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 8. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 9. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread)
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (corrupt_tcb_intent thread) (as_user thread (setRegister badge_register 0))
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ?Q93 ?Q'93 (corrupt_tcb_intent thread) (as_user thread (setRegister badge_register 0))
 2. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q93 sa
 3. \<And>sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint IdleEP) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = IdleEP; kheap s ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep s = {}; none_is_receiving_ep ep s; \<not> is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'93 sa
 4. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 5. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>ep_at ep sa; ko_at (kernel_object.Endpoint IdleEP) ep sa; not_idle_thread thread sa; not_idle_thread (cur_thread sa) sa; st_tcb_at active thread sa; valid_state sa; valid_etcbs sa; rv = IdleEP; kheap sa ep = Some (kernel_object.Endpoint IdleEP); ep_waiting_set_send ep sa = {}; none_is_receiving_ep ep sa; \<not> is_blocking; s = sa\<rbrakk> \<Longrightarrow> valid_idle sa
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> kheap s (?epptr98 s' x2) = Some (kernel_object.Endpoint (?endpoint98 s' x2))
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (?endpoint98 s' x2) (?epptr98 s' x2) s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (SendEP x2) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (SendEP x2) ep s\<rbrakk> \<Longrightarrow> valid_idle s'
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (SendEP x2) ep s\<rbrakk> \<Longrightarrow> valid_etcbs s'
 3. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (SendEP x2) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_send ep s') >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (SendEP x2) ep s\<rbrakk> \<Longrightarrow> valid_etcbs s'
 2. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (SendEP x2) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_send ep s') >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = SendEP x2; valid_ep_abstract (SendEP x2) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_send ep s') >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP x2)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP x2; kheap s ep = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send ep s; none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s p' \<longrightarrow> ep = p'\<rbrakk> \<Longrightarrow> (ep_waiting_set_send ep s = {} \<longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do y <- set_endpoint ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2));
sender_state <- get_thread_state (hd x2);
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer (hd x2) (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap (hd x2) thread can_grant else set_thread_state (hd x2) Inactive else do y <- set_thread_state (hd x2) Running;
possible_switch_to (hd x2)
od
od)) \<and> (ep_waiting_set_send ep s \<noteq> {} \<longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (do a <- select (ep_waiting_set_send ep s);
tcb <- get_thread a;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) a thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap a thread can_grant) \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case tl x2 of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl x2));
sender_state <- get_thread_state (hd x2);
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer (hd x2) (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap (hd x2) thread can_grant else set_thread_state (hd x2) Inactive else do y <- set_thread_state (hd x2) Running;
possible_switch_to (hd x2)
od
od))
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>list. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP list)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP list; kheap s ep = Some (kernel_object.Endpoint (SendEP list)); list \<noteq> []; set list = ep_waiting_set_send ep s; none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP list)) = kheap s p' \<longrightarrow> ep = p'\<rbrakk> \<Longrightarrow> (ep_waiting_set_send ep s = {} \<longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do y <- set_endpoint ep (case tl list of [] \<Rightarrow> IdleEP | a # lista \<Rightarrow> SendEP (tl list));
sender_state <- get_thread_state (hd list);
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer (hd list) (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap (hd list) thread can_grant else set_thread_state (hd list) Inactive else do y <- set_thread_state (hd list) Running;
possible_switch_to (hd list)
od
od)) \<and> (ep_waiting_set_send ep s \<noteq> {} \<longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (do a <- select (ep_waiting_set_send ep s);
tcb <- get_thread a;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) a thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap a thread can_grant) \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case tl list of [] \<Rightarrow> IdleEP | a # lista \<Rightarrow> SendEP (tl list));
sender_state <- get_thread_state (hd list);
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer (hd list) (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap (hd list) thread can_grant else set_thread_state (hd list) Inactive else do y <- set_thread_state (hd list) Running;
possible_switch_to (hd list)
od
od))
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>list. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP list)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP list; kheap s ep = Some (kernel_object.Endpoint (SendEP list)); list \<noteq> []; none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP list)) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = set list\<rbrakk> \<Longrightarrow> (ep_waiting_set_send ep s = {} \<longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do y <- set_endpoint ep (case tl list of [] \<Rightarrow> IdleEP | a # lista \<Rightarrow> SendEP (tl list));
sender_state <- get_thread_state (hd list);
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer (hd list) (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap (hd list) thread can_grant else set_thread_state (hd list) Inactive else do y <- set_thread_state (hd list) Running;
possible_switch_to (hd list)
od
od)) \<and> (ep_waiting_set_send ep s \<noteq> {} \<longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (do a <- select (ep_waiting_set_send ep s);
tcb <- get_thread a;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) a thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap a thread can_grant) \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case tl list of [] \<Rightarrow> IdleEP | a # lista \<Rightarrow> SendEP (tl list));
sender_state <- get_thread_state (hd list);
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer (hd list) (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap (hd list) thread can_grant else set_thread_state (hd list) Inactive else do y <- set_thread_state (hd list) Running;
possible_switch_to (hd list)
od
od))
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>list. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP list)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP list; kheap s ep = Some (kernel_object.Endpoint (SendEP list)); list \<noteq> []; none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP list)) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = set list\<rbrakk> \<Longrightarrow> ep_waiting_set_send ep s \<noteq> {} \<longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (do a <- select (ep_waiting_set_send ep s);
tcb <- get_thread a;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) a thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap a thread can_grant) \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case tl list of [] \<Rightarrow> IdleEP | a # lista \<Rightarrow> SendEP (tl list));
sender_state <- get_thread_state (hd list);
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer (hd list) (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap (hd list) thread can_grant else set_thread_state (hd list) Inactive else do y <- set_thread_state (hd list) Running;
possible_switch_to (hd list)
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (do a <- select (insert t (set ts));
tcb <- get_thread a;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) a thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap a thread can_grant) \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (a, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (5 subgoals):
 1. \<And>t ts. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts)\<rbrakk> \<Longrightarrow> transform s = transform s
 2. \<And>t ts. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts)\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. t \<in> insert t (set ts))) (transform s)
 3. \<And>t ts. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts)\<rbrakk> \<Longrightarrow> s = s
 4. \<And>t ts sa s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts); sa = transform s'; True; s = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) sa) ((=) s') (do tcb <- get_thread t;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 5. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>t ts. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts)\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. t \<in> insert t (set ts))) (transform s)
 2. \<And>t ts. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts)\<rbrakk> \<Longrightarrow> s = s
 3. \<And>t ts sa s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts); sa = transform s'; True; s = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) sa) ((=) s') (do tcb <- get_thread t;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>t ts. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts)\<rbrakk> \<Longrightarrow> s = s
 2. \<And>t ts sa s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts); sa = transform s'; True; s = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) sa) ((=) s') (do tcb <- get_thread t;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts sa s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; ep_waiting_set_send ep s = insert t (set ts); sa = transform s'; True; s = s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) sa) ((=) s') (do tcb <- get_thread t;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts sa s'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; sa = transform s'; True; s = s'; t \<in> ep_waiting_set_send ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) sa) ((=) s') (do tcb <- get_thread t;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts ta payload. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB ta); tcb_state ta = BlockedOnSend ep payload\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- get;
x <- assert_opt (cdl_objects x t);
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- get;
x <- assert_opt (cdl_objects x t);
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- assert_opt (cdl_objects (transform s) t);
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- assert_opt (cdl_objects (transform s) t);
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (5 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> get_tcb t s = Some (?tcb149 t ts tcb payload etcb)
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> get_etcb t s = Some (?etcb149 t ts tcb payload etcb)
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- assert_opt (Some (transform_tcb (machine_state s) t (?tcb149 t ts tcb payload etcb) (?etcb149 t ts tcb payload etcb)));
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 5. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> get_etcb t s = Some (?etcb149 t ts tcb payload etcb)
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- assert_opt (Some (transform_tcb (machine_state s) t tcb (?etcb149 t ts tcb payload etcb)));
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- assert_opt (Some (transform_tcb (machine_state s) t tcb etcb));
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (6 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> valid_idle s
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> t \<in> set (t # ts)
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP (t # ts))) (?epptr155 t ts tcb payload etcb) s
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; not_idle_thread t s\<rbrakk> \<Longrightarrow> t \<noteq> idle_thread s
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- assert_opt (Some (transform_tcb (machine_state s) t tcb etcb));
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 6. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do x <- assert_opt (Some (transform_tcb (machine_state s) t tcb etcb));
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) t thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (t, tcb_pending_op_slot) cdl_cap.NullCap
od
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) ((=) s) (do y <- Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload);
when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap
od) (do y <- set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)));
sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) (?Q'161 t ts tcb payload etcb rva) (do y <- Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload);
when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap
od) (do sender_state <- get_thread_state t;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 3. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (7 subgoals):
 1. \<And>t ts tcb payload etcb rva sender_state. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) (?Q'165 t ts tcb payload etcb rva sender_state) (do y <- Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload);
when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap
od) (do payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>?Q'165 t ts tcb payload etcb rva\<rbrace>
 3. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 6. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (7 subgoals):
 1. \<And>t ts tcb payload etcb rva sender_state. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; sender_state = tcb_state tcb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s)) (?P'170 t ts tcb payload etcb rva sender_state) (do y <- Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload);
when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap
od) (do payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 3. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 6. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (7 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) (?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload)) (do y <- Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload);
when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap
od) (do y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 3. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 6. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (9 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc (?Q176 t ts tcb payload etcb) (?Q'176 t ts tcb payload etcb) (do y <- Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload);
when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap
od) (do y <- Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od
od)
 2. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ?Q176 t ts tcb payload etcb sa
 3. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> ?Q'176 t ts tcb payload etcb sa
 4. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 5. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 7. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 8. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (12 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> Some ep = Some ep
 2. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?R'180 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od)
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>?R180 t ts tcb payload etcb\<rbrace>
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>?R'180 t ts tcb payload etcb\<rbrace>
 5. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 6. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 7. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 8. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 9. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 10. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?R'180 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive else do y <- set_thread_state t Running;
possible_switch_to t
od)
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>?R180 t ts tcb payload etcb\<rbrace>
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>?R'180 t ts tcb payload etcb\<rbrace>
 4. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 5. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 6. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 7. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 9. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 10. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q188 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap t thread can_grant else set_thread_state t Inactive)
 2. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q'190 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>?R180 t ts tcb payload etcb\<rbrace>
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> ?Q188 t ts tcb payload etcb rv' s) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 5. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 6. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 7. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 8. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 9. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 10. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; sender_is_call payload; sender_can_grant payload \<or> sender_can_grant_reply payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q195 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (setup_caller_cap t thread can_grant)
 2. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; sender_is_call payload; \<not> (sender_can_grant payload \<or> sender_can_grant_reply payload)\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q'197 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (set_thread_state t Inactive)
 3. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q'190 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>?R180 t ts tcb payload etcb\<rbrace>
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> ?Q195 t ts tcb payload etcb rv' s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> ?Q'197 t ts tcb payload etcb rv' s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 6. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 7. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 9. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 10. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; sender_is_call payload; sender_can_grant payload \<or> sender_can_grant_reply payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb ()) (?Q195 t ts tcb payload etcb ()) (inject_reply_cap t thread can_grant \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (setup_caller_cap t thread can_grant)
 2. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; sender_is_call payload; \<not> (sender_can_grant payload \<or> sender_can_grant_reply payload)\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q'197 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (set_thread_state t Inactive)
 3. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q'190 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>?R180 t ts tcb payload etcb\<rbrace>
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> ?Q195 t ts tcb payload etcb rv' s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> ?Q'197 t ts tcb payload etcb rv' s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 6. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 7. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 9. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 10. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; sender_is_call payload; sender_can_grant payload \<or> sender_can_grant_reply payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb ()) (?Q195 t ts tcb payload etcb ()) (inject_reply_cap t thread can_grant) (setup_caller_cap t thread can_grant)
 2. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; sender_is_call payload; \<not> (sender_can_grant payload \<or> sender_can_grant_reply payload)\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q'197 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (set_thread_state t Inactive)
 3. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (?R180 t ts tcb payload etcb rva) (?Q'190 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>?R180 t ts tcb payload etcb\<rbrace>
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> ?Q195 t ts tcb payload etcb rv' s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> ?Q'197 t ts tcb payload etcb rv' s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 6. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 7. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 9. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 10. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; sender_is_call payload; sender_can_grant payload \<or> sender_can_grant_reply payload\<rbrakk> \<Longrightarrow> t \<noteq> thread
 2. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; sender_is_call payload; \<not> (sender_can_grant payload \<or> sender_can_grant_reply payload)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'197 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (set_thread_state t Inactive)
 3. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'190 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread t and not_idle_thread thread and tcb_at t and tcb_at thread and st_tcb_at (Not \<circ> halted) t and valid_objs and valid_etcbs) s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> ?Q'197 t ts tcb payload etcb rv' s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 6. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 7. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 9. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 10. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; sender_is_call payload; \<not> (sender_can_grant payload \<or> sender_can_grant_reply payload)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'197 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (set_thread_state t Inactive)
 2. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'190 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread t and not_idle_thread thread and tcb_at t and tcb_at thread and st_tcb_at (Not \<circ> halted) t and valid_objs and valid_etcbs) s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> ?Q'197 t ts tcb payload etcb rv' s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 5. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 6. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 7. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 8. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 9. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 10. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'190 t ts tcb payload etcb rv') (when (sender_can_grant payload \<or> sender_can_grant_reply payload) (inject_reply_cap t thread can_grant) \<sqinter> KHeap_D.set_cap (t, 5) RunningCap \<sqinter> KHeap_D.set_cap (t, 5) cdl_cap.NullCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread t and not_idle_thread thread and tcb_at t and tcb_at thread and st_tcb_at (Not \<circ> halted) t and valid_objs and valid_etcbs) s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> (not_idle_thread t and K (cdl_cap.NullCap = infer_tcb_pending_op t Inactive) and valid_etcbs) s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 4. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 5. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 6. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 7. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 9. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 10. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'190 t ts tcb payload etcb rv') (KHeap_D.set_cap (t, 5) RunningCap) (do y <- set_thread_state t Running;
possible_switch_to t
od)
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread t and not_idle_thread thread and tcb_at t and tcb_at thread and st_tcb_at (Not \<circ> halted) t and valid_objs and valid_etcbs) s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> (not_idle_thread t and K (cdl_cap.NullCap = infer_tcb_pending_op t Inactive) and valid_etcbs) s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 4. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 5. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 6. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 7. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 9. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 10. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>t ts tcb payload etcb rva rv'. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; dc rva rv'; \<not> sender_is_call payload\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'190 t ts tcb payload etcb rv') (KHeap_D.set_cap (t, 5) RunningCap) (set_thread_state t Running)
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread t and not_idle_thread thread and tcb_at t and tcb_at thread and st_tcb_at (Not \<circ> halted) t and valid_objs and valid_etcbs) s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> (not_idle_thread t and K (cdl_cap.NullCap = infer_tcb_pending_op t Inactive) and valid_etcbs) s)) \<and> (\<not> sender_is_call payload \<longrightarrow> ?Q'190 t ts tcb payload etcb rv' s)\<rbrace>
 4. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 5. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 6. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 7. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 8. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 9. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 10. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q180 t ts tcb payload etcb\<rbrace> Endpoint_D.do_ipc_transfer (Some ep) t thread (sender_can_grant payload) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread t and not_idle_thread thread and tcb_at t and tcb_at thread and st_tcb_at (Not \<circ> halted) t and valid_objs and valid_etcbs) s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> (not_idle_thread t and K (cdl_cap.NullCap = infer_tcb_pending_op t Inactive) and valid_etcbs) s)) \<and> (\<not> sender_is_call payload \<longrightarrow> (not_idle_thread t and K (RunningCap = infer_tcb_pending_op t Running) and valid_etcbs) s)\<rbrace>
 3. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q180 t ts tcb payload etcb) sa
 4. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 5. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 6. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 7. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 8. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 9. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (9 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 t ts tcb payload etcb\<rbrace> Ipc_A.do_ipc_transfer t (Some ep) (sender_badge payload) (sender_can_grant payload) thread \<lbrace>\<lambda>rv' s. (sender_is_call payload \<longrightarrow> (sender_can_grant payload \<or> sender_can_grant_reply payload \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread t and not_idle_thread thread and tcb_at t and tcb_at thread and st_tcb_at (Not \<circ> halted) t and valid_objs and valid_etcbs) s) \<and> (\<not> (sender_can_grant payload \<or> sender_can_grant_reply payload) \<longrightarrow> (not_idle_thread t and K (cdl_cap.NullCap = infer_tcb_pending_op t Inactive) and valid_etcbs) s)) \<and> (\<not> sender_is_call payload \<longrightarrow> (not_idle_thread t and K (RunningCap = infer_tcb_pending_op t Running) and valid_etcbs) s)\<rbrace>
 2. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; transform s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) sa
 3. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?P'170 t ts tcb payload etcb () (BlockedOnSend ep payload) sa\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread thread and not_idle_thread t and valid_etcbs and ?Q'180 t ts tcb payload etcb) sa
 4. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'161 t ts tcb payload etcb rva\<rbrace> get_thread_state t \<lbrace>\<lambda>sender_state. ?P'170 t ts tcb payload etcb rva sender_state and (\<lambda>s. sender_state = tcb_state tcb)\<rbrace>
 5. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; ?Q'161 t ts tcb payload etcb rva sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> get_thread_state t \<lbrace>\<lambda>r. (=) sa\<rbrace>
 6. \<And>t ts tcb payload etcb rva. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; False\<rbrakk> \<Longrightarrow> no_fail (?Q'161 t ts tcb payload etcb rva) (get_thread_state t)
 7. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>?Q'161 t ts tcb payload etcb\<rbrace>
 8. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'313 t ts tcb payload etcb\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>rv s. cur_thread s \<noteq> idle_thread s \<and> valid_irq_node s \<and> valid_idle s \<and> thread \<noteq> idle_thread s \<and> t \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_mdb s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> t \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> tcb_at t s \<and> tcb_at thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> valid_objs s \<and> valid_mdb s \<and> valid_etcbs s \<and> t \<noteq> idle_thread s \<and> valid_etcbs s \<and> st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t s\<rbrace>
 2. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> ?P'313 t ts tcb payload etcb sa
 3. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (5 subgoals):
 1. \<And>t ts tcb payload etcb rva sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; (valid_mdb and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread t and not_idle_thread thread and valid_idle and valid_irq_node and (\<lambda>s. cur_thread s \<noteq> idle_thread s) and tcb_at t and tcb_at thread and st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t and valid_etcbs) sa\<rbrakk> \<Longrightarrow> cur_thread sa \<noteq> idle_thread sa \<and> valid_irq_node sa \<and> valid_idle sa \<and> thread \<noteq> idle_thread sa \<and> t \<noteq> idle_thread sa \<and> valid_etcbs sa \<and> valid_mdb sa \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_idle sa \<and> t \<noteq> idle_thread sa \<and> thread \<noteq> idle_thread sa \<and> tcb_at t sa \<and> tcb_at thread sa \<and> st_tcb_at (\<lambda>a. \<not> halted a) t sa \<and> valid_objs sa \<and> valid_mdb sa \<and> valid_etcbs sa \<and> t \<noteq> idle_thread sa \<and> valid_etcbs sa \<and> st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t sa
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'313 t ts tcb payload etcb\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>fault. valid_mdb and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread t and not_idle_thread thread and valid_idle and valid_irq_node and (\<lambda>s. cur_thread s \<noteq> idle_thread s) and tcb_at t and tcb_at thread and st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t and valid_etcbs\<rbrace>
 3. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> ?P'313 t ts tcb payload etcb sa
 4. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (5 subgoals):
 1. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; valid_mdb sa; valid_objs sa; pspace_aligned sa; pspace_distinct sa; t \<noteq> idle_thread sa; thread \<noteq> idle_thread sa; valid_idle sa; valid_irq_node sa; cur_thread sa \<noteq> idle_thread sa; tcb_at t sa; tcb_at thread sa; st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t sa; valid_etcbs sa\<rbrakk> \<Longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t sa
 2. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'313 t ts tcb payload etcb\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>fault. valid_mdb and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread t and not_idle_thread thread and valid_idle and valid_irq_node and (\<lambda>s. cur_thread s \<noteq> idle_thread s) and tcb_at t and tcb_at thread and st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t and valid_etcbs\<rbrace>
 3. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> ?P'313 t ts tcb payload etcb sa
 4. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>?P'313 t ts tcb payload etcb\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>fault. valid_mdb and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread t and not_idle_thread thread and valid_idle and valid_irq_node and (\<lambda>s. cur_thread s \<noteq> idle_thread s) and tcb_at t and tcb_at thread and st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t and valid_etcbs\<rbrace>
 2. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> ?P'313 t ts tcb payload etcb sa
 3. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> valid_mdb sa \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> t \<noteq> idle_thread sa \<and> thread \<noteq> idle_thread sa \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) ep and valid_idle) sa \<and> (valid_irq_node and ep_at ep) sa \<and> cur_thread sa \<noteq> idle_thread sa \<and> tcb_at t sa \<and> tcb_at thread sa \<and> st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t sa \<and> valid_etcbs sa
 2. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (6 subgoals):
 1. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> valid_idle s
 2. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> t \<in> set (t # ts)
 3. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP (t # ts))) (?epptr395 t ts tcb payload etcb sa) s
 4. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa; not_idle_thread t s\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> valid_mdb sa \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> t \<noteq> idle_thread sa \<and> thread \<noteq> idle_thread sa \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) ep and valid_idle) sa \<and> (valid_irq_node and ep_at ep) sa \<and> cur_thread sa \<noteq> idle_thread sa \<and> tcb_at t sa \<and> tcb_at thread sa \<and> st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t sa \<and> valid_etcbs sa
 5. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>t ts tcb payload etcb. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP (t # ts))) (?epptr395 t ts tcb payload etcb s) s
 2. \<And>t ts tcb payload etcb sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; s = sa; not_idle_thread t s\<rbrakk> \<Longrightarrow> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> valid_mdb sa \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))) and K (is_simple_type (kernel_object.Endpoint (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts)))))) sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> t \<noteq> idle_thread sa \<and> thread \<noteq> idle_thread sa \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) ep and valid_idle) sa \<and> (valid_irq_node and ep_at ep) sa \<and> cur_thread sa \<noteq> idle_thread sa \<and> tcb_at t sa \<and> tcb_at thread sa \<and> st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t sa \<and> valid_etcbs sa
 3. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>t ts tcb payload etcb sa. \<lbrakk>is_ep (kernel_object.Endpoint (SendEP (t # ts))); kheap sa ep = Some (kernel_object.Endpoint (SendEP (t # ts))); thread \<noteq> idle_thread sa; cur_thread sa \<noteq> idle_thread sa; st_tcb_at active thread sa; valid_state sa; valid_etcbs sa; rv = SendEP (t # ts); none_is_receiving_ep ep sa; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap sa p' \<longrightarrow> ep = p'; kheap sa t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap sa t = Some etcb; s = sa; t \<noteq> idle_thread sa\<rbrakk> \<Longrightarrow> valid_objs sa \<and> valid_ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) sa \<and> pspace_aligned sa \<and> valid_global_refs sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> valid_objs sa \<and> valid_ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_idle sa \<and> valid_irq_node sa \<and> (\<exists>ko. kheap sa thread = Some ko \<and> is_tcb ko) \<and> st_tcb_at (\<lambda>rv. rv = BlockedOnSend ep payload) t sa
 2. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>t ts tcb payload etcb tcba. \<lbrakk>is_ep (kernel_object.Endpoint (SendEP (t # ts))); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; valid_etcbs s; rv = SendEP (t # ts); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; t \<noteq> idle_thread s; valid_objs s; kheap s thread = Some (TCB tcba); pspace_aligned s; active (tcb_state tcba); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> valid_ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) s
 2. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>t ts tcb payload etcb tcba. \<lbrakk>is_ep (kernel_object.Endpoint (SendEP (t # ts))); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; valid_etcbs s; rv = SendEP (t # ts); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; t \<noteq> idle_thread s; kheap s thread = Some (TCB tcba); pspace_aligned s; active (tcb_state tcba); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> kheap s (?epptr464 t ts tcb payload etcb tcba) = Some (kernel_object.Endpoint (?ep464 t ts tcb payload etcb tcba))
 2. \<And>t ts tcb payload etcb tcba. \<lbrakk>is_ep (kernel_object.Endpoint (SendEP (t # ts))); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; valid_etcbs s; rv = SendEP (t # ts); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; t \<noteq> idle_thread s; kheap s thread = Some (TCB tcba); pspace_aligned s; active (tcb_state tcba); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; valid_ep (?ep464 t ts tcb payload etcb tcba) s\<rbrakk> \<Longrightarrow> valid_ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) s
 3. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>t ts tcb payload etcb tcba. \<lbrakk>is_ep (kernel_object.Endpoint (SendEP (t # ts))); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; valid_etcbs s; rv = SendEP (t # ts); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; t \<noteq> idle_thread s; kheap s thread = Some (TCB tcba); pspace_aligned s; active (tcb_state tcba); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; valid_ep (SendEP (t # ts)) s\<rbrakk> \<Longrightarrow> valid_ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) s
 2. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>t ts tcb payload etcb cs. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (SendEP (t # ts))) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_etcbs s; rv = SendEP (t # ts); kheap s ep = Some (kernel_object.Endpoint (SendEP (t # ts))); none_is_receiving_ep ep s; \<forall>p'. Some (kernel_object.Endpoint (SendEP (t # ts))) = kheap s p' \<longrightarrow> ep = p'; kheap s t = Some (TCB tcb); tcb_state tcb = BlockedOnSend ep payload; ekheap s t = Some etcb; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>_. True) (return (?x516 t ts tcb payload etcb cs)) (set_endpoint ep (case ts of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (tl (t # ts))))
 2. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>s' x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint rv) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; transform s = transform s'; s = s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_send_threads ep (transform s')) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case rv of IdleEP \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint ep $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue;
sender_state <- get_thread_state sender;
payload <- case sender_state of BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
Ipc_A.do_ipc_transfer sender (Some ep) (sender_badge payload) (sender_can_grant payload) thread;
if sender_is_call payload then if sender_can_grant payload \<or> sender_can_grant_reply payload then setup_caller_cap sender thread can_grant else set_thread_state sender Inactive else do set_thread_state sender Running;
do_extended_op (possible_switch_to sender)
od
od | RecvEP queue \<Rightarrow> case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (get_waiting_sync_send_threads ep (transform s)) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3\<rbrakk> \<Longrightarrow> kheap s (?epptr520 x3) = Some (kernel_object.Endpoint (?endpoint520 x3))
 2. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (?endpoint520 x3) (?epptr520 x3) s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (get_waiting_sync_send_threads ep (transform s)) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (RecvEP x3) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (get_waiting_sync_send_threads ep (transform s)) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (RecvEP x3) ep s\<rbrakk> \<Longrightarrow> valid_idle s
 2. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (RecvEP x3) ep s\<rbrakk> \<Longrightarrow> valid_etcbs s
 3. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (RecvEP x3) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (ep_waiting_set_send ep s) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (RecvEP x3) ep s\<rbrakk> \<Longrightarrow> valid_etcbs s
 2. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (RecvEP x3) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (ep_waiting_set_send ep s) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; valid_ep_abstract (RecvEP x3) ep s\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (option_select (ep_waiting_set_send ep s) >>= case_option (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (\<lambda>tcb_id_sender. do tcb <- get_thread tcb_id_sender;
case cdl_tcb_caps tcb tcb_pending_op_slot of Some (PendingSyncSendCap target xa call can_granta can_grant_reply fault) \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some ep) tcb_id_sender thread can_granta;
(when (can_granta \<or> can_grant_reply) $ inject_reply_cap tcb_id_sender thread can_grant) \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) RunningCap \<sqinter> KHeap_D.set_cap (tcb_id_sender, tcb_pending_op_slot) cdl_cap.NullCap
od
od)) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (case is_blocking of True \<Rightarrow> do set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) proof (prove)
goal (2 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od)
 2. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc (?Q535 x3) (?Q'535 x3) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od)
 2. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q535 x3 sa
 3. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'535 x3 sa
 4. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc (?Q535 x3) (?Q'535 x3) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant)) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od)
 2. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q535 x3 sa
 3. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'535 x3 sa
 4. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread) proof (prove)
goal (4 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc (?Q535 x3) (?Q'535 x3) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) >>= return) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od)
 2. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q535 x3 sa
 3. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'535 x3 sa
 4. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread) proof (prove)
goal (6 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking\<rbrakk> \<Longrightarrow> dcorres dc (?Q543 x3) (?Q'543 x3) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) >>= return) (do y <- set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>);
set_endpoint ep (RecvEP (x3 @ [thread]))
od)
 2. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; ?Q535 x3 sa\<rbrakk> \<Longrightarrow> ?Q543 x3 sa
 3. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; ?Q'535 x3 sa\<rbrakk> \<Longrightarrow> ?Q'543 x3 sa
 4. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q535 x3 sa
 5. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'535 x3 sa
 6. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread) proof (prove)
goal (7 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q547 x3\<rbrace> block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'547 x3\<rbrace> set_thread_state thread (BlockedOnReceive ep \<lparr>receiver_can_grant = can_grant\<rparr>) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; ?Q535 x3 sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q547 x3) sa
 4. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; ?Q'535 x3 sa\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'547 x3) sa
 5. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q535 x3 sa
 6. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'535 x3 sa
 7. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (do_nbrecv_failed_transfer thread) proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (block_thread_on_ipc thread (PendingSyncRecvCap ep False can_grant) \<sqinter> corrupt_tcb_intent thread) (as_user thread (setRegister badge_register 0)) proof (prove)
goal (1 subgoal):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s)) ((=) s) (corrupt_tcb_intent thread) (as_user thread (setRegister badge_register 0)) proof (prove)
goal (3 subgoals):
 1. \<And>x3. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking\<rbrakk> \<Longrightarrow> dcorres dc (?Q615 x3) (?Q'615 x3) (corrupt_tcb_intent thread) (as_user thread (setRegister badge_register 0))
 2. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking; transform s = sa\<rbrakk> \<Longrightarrow> ?Q615 x3 sa
 3. \<And>x3 sa. \<lbrakk>ep_at ep s; ko_at (kernel_object.Endpoint (RecvEP x3)) ep s; not_idle_thread thread s; not_idle_thread (cur_thread s) s; st_tcb_at active thread s; valid_state s; valid_etcbs s; rv = RecvEP x3; kheap s ep = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv ep s; ep_waiting_set_send ep s = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s p' \<longrightarrow> ep = p'; \<not> is_blocking; s = sa\<rbrakk> \<Longrightarrow> ?Q'615 x3 sa proof (prove)
goal:
No subgoals!