theory Ipc_R

lemma sendIPC_corres:
(* call is only true if called in handleSyscall SysCall, which
   is always blocking. *)
  assumes "call \<longrightarrow> bl"
  shows
  "corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t)
             (invs' and  sch_act_not t and tcb_at' t and ep_at' ep)
             (send_ipc bl call bg cg cgr t ep) (sendIPC bl call bg cg cgr t ep)" proof - show ?thesis apply (insert assms) apply (unfold send_ipc_def sendIPC_def Let_def) apply (case_tac bl) apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split[OF getEndpoint_corres,
              where
              R="\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and
                      valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep
                      and ex_nonz_cap_to t"
              and
              R'="\<lambda>rv'. invs' and tcb_at' t and sch_act_not t
                              and ep_at' ep and valid_ep' rv'"]) apply (case_tac rv) apply (simp add: ep_relation_def) apply (rule corres_guard_imp) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule setEndpoint_corres) apply (simp add: ep_relation_def) apply wp+ apply (clarsimp simp: st_tcb_at_tcb_at valid_tcb_state_def) apply clarsimp
         \<comment> \<open>concludes IdleEP if bl branch\<close> apply (simp add: ep_relation_def) apply (rule corres_guard_imp) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule setEndpoint_corres) apply (simp add: ep_relation_def) apply wp+ apply (clarsimp simp: st_tcb_at_tcb_at valid_tcb_state_def) apply clarsimp
        \<comment> \<open>concludes SendEP if bl branch\<close> apply (simp add: ep_relation_def) apply (rename_tac list) apply (rule_tac F="list \<noteq> []" in corres_req) apply (simp add: valid_ep_def) apply (case_tac list) apply simp apply (clarsimp split del: if_split) apply (rule corres_guard_imp) apply (rule corres_split[OF setEndpoint_corres]) apply (simp add: ep_relation_def split: list.split) apply (simp add: isReceive_def split del:if_split) apply (rule corres_split[OF getThreadState_corres]) apply (rule_tac
                    F="\<exists>data. recv_state = Structures_A.BlockedOnReceive ep data"
                    in corres_gen_asm) apply (clarsimp simp: case_bool_If  case_option_If if3_fold
                         simp del: dc_simp split del: if_split cong: if_cong) apply (rule corres_split[OF doIPCTransfer_corres]) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule corres_split[OF possibleSwitchTo_corres]) apply (fold when_def)[1] apply (rule_tac P="call" and P'="call"
                            in corres_symmetric_bool_cases, blast) apply (simp add: when_def dc_def[symmetric] split del: if_split) apply (rule corres_if2, simp) apply (rule setupCallerCap_corres) apply (rule setThreadState_corres, simp) apply (rule corres_trivial) apply (simp add: when_def dc_def[symmetric] split del: if_split) apply (simp split del: if_split add: if_apply_def2) apply (wp hoare_drop_imps)[1] apply (simp split del: if_split add: if_apply_def2) apply (wp hoare_drop_imps)[1] apply (wp | simp)+ apply (wp sts_cur_tcb set_thread_state_runnable_weak_valid_sched_action sts_st_tcb_at_cases) apply (wp setThreadState_valid_queues' sts_valid_queues sts_weak_sch_act_wf
                         sts_cur_tcb' setThreadState_tcb' sts_st_tcb_at'_cases)[1] apply (simp add: valid_tcb_state_def pred_conj_def) apply (strengthen reply_cap_doesnt_exist_strg disjI2_strg) apply ((wp hoare_drop_imps do_ipc_transfer_tcb_caps weak_valid_sched_action_lift
                   | clarsimp simp: is_cap_simps)+)[1] apply (simp add: pred_conj_def) apply (strengthen sch_act_wf_weak) apply (simp add: valid_tcb_state'_def) apply (wp weak_sch_act_wf_lift_linear tcb_in_cur_domain'_lift hoare_drop_imps)[1] apply (wp gts_st_tcb_at)+ apply (simp add: pred_conj_def cong: conj_cong) apply (wp hoare_post_taut) apply (simp) apply (wp weak_sch_act_wf_lift_linear set_ep_valid_objs' setEndpoint_valid_mdb')+ apply (clarsimp simp add: invs_def valid_state_def valid_pspace_def ep_redux_simps
                        ep_redux_simps' st_tcb_at_tcb_at valid_ep_def
                        cong: list.case_cong) apply (drule(1) sym_refs_obj_atD[where P="\<lambda>ob. ob = e" for e]) apply (clarsimp simp: st_tcb_at_refs_of_rev st_tcb_at_reply_cap_valid
                              st_tcb_def2 valid_sched_def valid_sched_action_def) apply (force simp: st_tcb_def2 dest!: st_tcb_at_caller_cap_null[simplified,rotated]) subgoal by (auto simp: valid_ep'_def invs'_def valid_state'_def split: list.split) apply wp+ apply (clarsimp simp: ep_at_def2)+ apply (rule corres_guard_imp) apply (rule corres_split[OF getEndpoint_corres,
             where
             R="\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and
                     valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep"
             and
             R'="\<lambda>rv'. invs' and tcb_at' t and sch_act_not t
                             and ep_at' ep and valid_ep' rv'"]) apply (rename_tac rv rv') apply (case_tac rv) apply (simp add: ep_relation_def)
        \<comment> \<open>concludes IdleEP branch if not bl and no ft\<close> apply (simp add: ep_relation_def)
       \<comment> \<open>concludes SendEP branch if not bl and no ft\<close> apply (simp add: ep_relation_def) apply (rename_tac list) apply (rule_tac F="list \<noteq> []" in corres_req) apply (simp add: valid_ep_def) apply (case_tac list) apply simp apply (rule_tac F="a \<noteq> t" in corres_req) apply (clarsimp simp: invs_def valid_state_def
                             valid_pspace_def) apply (drule(1) sym_refs_obj_atD[where P="\<lambda>ob. ob = e" for e]) apply (clarsimp simp: st_tcb_at_def obj_at_def tcb_bound_refs_def2) apply fastforce apply (clarsimp split del: if_split) apply (rule corres_guard_imp) apply (rule corres_split[OF setEndpoint_corres]) apply (simp add: ep_relation_def split: list.split) apply (rule corres_split[OF getThreadState_corres]) apply (rule_tac
               F="\<exists>data. recv_state = Structures_A.BlockedOnReceive ep data"
                   in corres_gen_asm) apply (clarsimp simp: isReceive_def case_bool_If
                       split del: if_split cong: if_cong) apply (rule corres_split[OF doIPCTransfer_corres]) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule possibleSwitchTo_corres) apply (simp add: if_apply_def2) apply ((wp sts_cur_tcb set_thread_state_runnable_weak_valid_sched_action sts_st_tcb_at_cases |
                          simp add: if_apply_def2 split del: if_split)+)[1] apply (wp setThreadState_valid_queues' sts_valid_queues sts_weak_sch_act_wf
                        sts_cur_tcb' setThreadState_tcb' sts_st_tcb_at'_cases) apply (simp add: valid_tcb_state_def pred_conj_def) apply ((wp hoare_drop_imps do_ipc_transfer_tcb_caps  weak_valid_sched_action_lift
                    | clarsimp simp:is_cap_simps)+)[1] apply (simp add: valid_tcb_state'_def pred_conj_def) apply (strengthen sch_act_wf_weak) apply (wp weak_sch_act_wf_lift_linear hoare_drop_imps) apply (wp gts_st_tcb_at)+ apply (simp add: pred_conj_def cong: conj_cong) apply (wp hoare_post_taut) apply simp apply (wp weak_sch_act_wf_lift_linear set_ep_valid_objs' setEndpoint_valid_mdb') apply (clarsimp simp add: invs_def valid_state_def
                                 valid_pspace_def ep_redux_simps ep_redux_simps'
                                 st_tcb_at_tcb_at
                           cong: list.case_cong) apply (clarsimp simp: valid_ep_def) apply (drule(1) sym_refs_obj_atD[where P="\<lambda>ob. ob = e" for e]) apply (clarsimp simp: st_tcb_at_refs_of_rev st_tcb_at_reply_cap_valid
                             st_tcb_at_caller_cap_null) apply (fastforce simp: st_tcb_def2 valid_sched_def valid_sched_action_def) subgoal by (auto simp: valid_ep'_def
                      split: list.split;
                  clarsimp simp: invs'_def valid_state'_def) apply wp+ apply (clarsimp simp: ep_at_def2)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (send_ipc bl call bg cg cgr t ep) (sendIPC bl call bg cg cgr t ep) proof (state)
goal (1 subgoal):
 1. corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (send_ipc bl call bg cg cgr t ep) (sendIPC bl call bg cg cgr t ep) proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (send_ipc bl call bg cg cgr t ep) (sendIPC bl call bg cg cgr t ep) proof (prove)
goal (1 subgoal):
 1. call \<longrightarrow> bl \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (send_ipc bl call bg cg cgr t ep) (sendIPC bl call bg cg cgr t ep) proof (prove)
goal (1 subgoal):
 1. call \<longrightarrow> bl \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>call \<longrightarrow> bl; bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od)
 2. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (2 subgoals):
 1. bl \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (get_endpoint ep >>= Structures_A.endpoint.case_endpoint (do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od) (\<lambda>queue. do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od) (case_list fail (\<lambda>dest queue. do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od))) (getEndpoint ep >>= Structures_H.endpoint.case_endpoint (case_list fail (\<lambda>dest queue. do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)) (do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od) (\<lambda>queue. do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od))
 2. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (4 subgoals):
 1. bl \<Longrightarrow> corres dc ?Q8 ?Q'8 (get_endpoint ep >>= Structures_A.endpoint.case_endpoint (do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od) (\<lambda>queue. do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od) (case_list fail (\<lambda>dest queue. do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od))) (getEndpoint ep >>= Structures_H.endpoint.case_endpoint (case_list fail (\<lambda>dest queue. do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)) (do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od) (\<lambda>queue. do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od))
 2. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> ?Q8 s
 3. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> ?Q'8 s
 4. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>rv rv'. \<lbrakk>bl; ep_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (8 subgoals):
 1. \<And>rv rv'. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 2. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 3. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 4. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 5. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 7. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 8. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (8 subgoals):
 1. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>ob. ob = Endpoint Structures_A.endpoint.IdleEP) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) (do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od) (do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od)
 2. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 3. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 4. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 5. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 7. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 8. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (10 subgoals):
 1. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (?Q18 rv rv') (?Q'18 rv rv') (do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od) (do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od)
 2. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (einvs and st_tcb_at active t and ep_at ep and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>ob. ob = Endpoint Structures_A.endpoint.IdleEP) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> ?Q18 rv rv' s
 3. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> ?Q'18 rv rv' s
 4. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 5. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 6. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 7. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 8. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 9. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 10. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (13 subgoals):
 1. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> thread_state_relation (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call)
 2. \<And>rv rv' y ya. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R22 rv rv' y) (?R'22 rv rv' ya) (set_endpoint ep (Structures_A.endpoint.SendEP [t])) (setEndpoint ep (Structures_H.endpoint.SendEP [t]))
 3. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 rv rv'\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>?R22 rv rv'\<rbrace>
 4. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>?R'22 rv rv'\<rbrace>
 5. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (einvs and st_tcb_at active t and ep_at ep and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>ob. ob = Endpoint Structures_A.endpoint.IdleEP) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q22 rv rv') s
 6. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'22 rv rv') s
 7. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 8. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 9. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 10. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' y ya. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R22 rv rv' y) (?R'22 rv rv' ya) (set_endpoint ep (Structures_A.endpoint.SendEP [t])) (setEndpoint ep (Structures_H.endpoint.SendEP [t]))
 2. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 rv rv'\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>?R22 rv rv'\<rbrace>
 3. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>?R'22 rv rv'\<rbrace>
 4. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (einvs and st_tcb_at active t and ep_at ep and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>ob. ob = Endpoint Structures_A.endpoint.IdleEP) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q22 rv rv') s
 5. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'22 rv rv') s
 6. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 7. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' y ya. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; dc y ya\<rbrakk> \<Longrightarrow> ep_relation (Structures_A.endpoint.SendEP [t]) (Structures_H.endpoint.SendEP [t])
 2. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 rv rv'\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y. ep_at ep\<rbrace>
 3. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>\<lambda>ya. ep_at' ep\<rbrace>
 4. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (einvs and st_tcb_at active t and ep_at ep and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>ob. ob = Endpoint Structures_A.endpoint.IdleEP) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q22 rv rv') s
 5. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'22 rv rv') s
 6. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 7. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 rv rv'\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y. ep_at ep\<rbrace>
 2. \<And>rv rv'. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>\<lambda>ya. ep_at' ep\<rbrace>
 3. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (einvs and st_tcb_at active t and ep_at ep and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>ob. ob = Endpoint Structures_A.endpoint.IdleEP) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q22 rv rv') s
 4. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'22 rv rv') s
 5. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 6. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 7. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 8. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 9. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 10. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (einvs and st_tcb_at active t and ep_at ep and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>ob. ob = Endpoint Structures_A.endpoint.IdleEP) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ep_at ep) s
 2. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ep_at' ep) s
 3. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 4. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 5. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 6. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 7. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 8. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 9. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' s. \<lbrakk>bl; rv' = Structures_H.endpoint.IdleEP; rv = Structures_A.endpoint.IdleEP; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ep_at' ep) s
 2. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 3. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 4. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 5. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 7. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 8. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' x2. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 2. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.SendEP x2)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) (do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (x2 @ [t]))
od) (do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (x2 @ [t]))
od)
 2. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (?Q49 rv rv' x2) (?Q'49 rv rv' x2) (do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (x2 @ [t]))
od) (do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (x2 @ [t]))
od)
 2. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.SendEP x2)) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> ?Q49 rv rv' x2 s
 3. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) s\<rbrakk> \<Longrightarrow> ?Q'49 rv rv' x2 s
 4. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 5. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 6. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 7. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 8. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 9. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> thread_state_relation (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call)
 2. \<And>rv rv' x2 y ya. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R53 rv rv' x2 y) (?R'53 rv rv' x2 ya) (set_endpoint ep (Structures_A.endpoint.SendEP (x2 @ [t]))) (setEndpoint ep (Structures_H.endpoint.SendEP (x2 @ [t])))
 3. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 rv rv' x2\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>?R53 rv rv' x2\<rbrace>
 4. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 rv rv' x2\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>?R'53 rv rv' x2\<rbrace>
 5. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.SendEP x2)) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q53 rv rv' x2) s
 6. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'53 rv rv' x2) s
 7. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' x2 y ya. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R53 rv rv' x2 y) (?R'53 rv rv' x2 ya) (set_endpoint ep (Structures_A.endpoint.SendEP (x2 @ [t]))) (setEndpoint ep (Structures_H.endpoint.SendEP (x2 @ [t])))
 2. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 rv rv' x2\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>?R53 rv rv' x2\<rbrace>
 3. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 rv rv' x2\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>?R'53 rv rv' x2\<rbrace>
 4. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.SendEP x2)) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q53 rv rv' x2) s
 5. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'53 rv rv' x2) s
 6. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 7. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 8. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 9. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 10. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' x2 y ya. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; dc y ya\<rbrakk> \<Longrightarrow> ep_relation (Structures_A.endpoint.SendEP (x2 @ [t])) (Structures_H.endpoint.SendEP (x2 @ [t]))
 2. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 rv rv' x2\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y. ep_at ep\<rbrace>
 3. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 rv rv' x2\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>\<lambda>ya. ep_at' ep\<rbrace>
 4. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.SendEP x2)) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q53 rv rv' x2) s
 5. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'53 rv rv' x2) s
 6. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 7. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 8. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 9. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 10. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 rv rv' x2\<rbrace> set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y. ep_at ep\<rbrace>
 2. \<And>rv rv' x2. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 rv rv' x2\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t \<lbrace>\<lambda>ya. ep_at' ep\<rbrace>
 3. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.SendEP x2)) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ?Q53 rv rv' x2) s
 4. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ?Q'53 rv rv' x2) s
 5. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 6. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 7. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 8. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 9. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 10. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.SendEP x2)) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (tcb_at t and ep_at ep) s
 2. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ep_at' ep) s
 3. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 4. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 5. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 7. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 8. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' x2 s. \<lbrakk>bl; rv' = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.SendEP x2)) s\<rbrakk> \<Longrightarrow> (tcb_at' t and ep_at' ep) s
 2. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' x3. \<lbrakk>bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.IdleEP \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP [t])
od | Structures_A.endpoint.SendEP queue \<Rightarrow> do y <- set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep (Structures_A.endpoint.SendEP (queue @ [t]))
od | Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP [t])
od | Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep (Structures_H.endpoint.SendEP (queue @ [t]))
od)
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' x3. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP x3; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP x3)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP x3)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' list. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP list)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' list s s'. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; (s, s') \<in> state_relation; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP list)) ep and ex_nonz_cap_to t) s; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) s'\<rbrakk> \<Longrightarrow> list \<noteq> []
 2. \<And>rv rv' list. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP list)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' list. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP list)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' list. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = []\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP list)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. \<And>rv rv' list a lista. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP list)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' list a lista. \<lbrakk>bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP list)) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
y <- possible_switch_to dest;
when call (if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) (do y <- set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista);
recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista);
recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (8 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> corres dc (?Q87 a lista) (?Q'87 a lista) (do y <- set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista);
recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista);
recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> ?Q87 a lista s
 3. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> ?Q'87 a lista s
 4. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 5. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 7. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 8. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (11 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> ep_relation (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)
 2. \<And>a lista y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R91 a lista y) (?R'91 a lista ya) (do recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (do recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>?R91 a lista\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>?R'91 a lista\<rbrace>
 5. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 6. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 7. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 8. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 9. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 10. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a lista y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R91 a lista y) (?R'91 a lista ya) (do recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (do recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>?R91 a lista\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>?R'91 a lista\<rbrace>
 4. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 5. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 6. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 7. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 8. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 9. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 10. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (10 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> corres dc (?R91 a lista ()) (?R'91 a lista ()) (do recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (do recvState <- getThreadState a;
y <- assert (case recvState of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> True | _ \<Rightarrow> False);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>?R91 a lista\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>?R'91 a lista\<rbrace>
 4. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 5. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 6. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 7. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 8. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 9. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 10. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (12 subgoals):
 1. \<And>a lista recv_state recvState. \<lbrakk>bl; thread_state_relation recv_state recvState\<rbrakk> \<Longrightarrow> corres dc (?R101 a lista recv_state) (?R'101 a lista recvState) (do reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- assert (case recvState of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> True | _ \<Rightarrow> False);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>?R101 a lista\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>?R'101 a lista\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 6. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 7. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista recv_state recvState. \<lbrakk>bl; thread_state_relation recv_state recvState; \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data\<rbrakk> \<Longrightarrow> corres dc (?P111 a lista recv_state) (?R'101 a lista recvState) (do reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- assert (case recvState of Structures_H.thread_state.BlockedOnReceive x xa \<Rightarrow> True | _ \<Rightarrow> False);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
case call of True \<Rightarrow> case cg \<or> cgr of True \<Rightarrow> setupCallerCap t a (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | False \<Rightarrow> return ()
od)
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. ?P111 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>?R'101 a lista\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 6. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 7. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> corres dc (?P111 a lista (Structures_A.thread_state.BlockedOnReceive ep data)) (?R'101 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))) (do y <- do_ipc_transfer t (Some ep) bg cg a;
y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
if call then if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t else return ()
od)
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. ?P111 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>?R'101 a lista\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 6. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 7. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R121 a lista data y) (?R'121 a lista data ya) (do y <- set_thread_state a Structures_A.thread_state.Running;
y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- setThreadState Structures_H.thread_state.Running a;
y <- possibleSwitchTo a;
if call then if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t else return ()
od)
 2. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>?R121 a lista data\<rbrace>
 3. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>?R'121 a lista data\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 8. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 9. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 10. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R130 a lista data y ya rv) (?R'130 a lista data y ya rv') (do y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- possibleSwitchTo a;
if call then if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t else return ()
od)
 3. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R130 a lista data y ya\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'130 a lista data y ya\<rbrace>
 5. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 6. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R130 a lista data y ya rv) (?R'130 a lista data y ya rv') (do y <- possible_switch_to a;
when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)
od) (do y <- possibleSwitchTo a;
if call then if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t else return ()
od)
 2. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R130 a lista data y ya\<rbrace>
 3. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'130 a lista data y ya\<rbrace>
 4. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 5. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 10. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R140 a lista data y ya rv rv' rva) (?R'140 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (if call then if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t else return ())
 2. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>?R140 a lista data y ya rv rv'\<rbrace>
 3. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>?R'140 a lista data y ya rv rv'\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 5. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 6. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 7. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R140 a lista data y ya rv rv' rva) (?R'140 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 2. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>?R140 a lista data y ya rv rv'\<rbrace>
 3. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>?R'140 a lista data y ya rv rv'\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 5. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 6. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 7. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a; call; call\<rbrakk> \<Longrightarrow> corres dc (?Q153 a lista data y ya rv rv' rva) (?Q'155 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 2. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a; \<not> call; \<not> call\<rbrakk> \<Longrightarrow> corres dc (?R154 a lista data y ya rv rv' rva) (?R'156 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 3. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. (call \<longrightarrow> ?Q153 a lista data y ya rv rv' rva s) \<and> (\<not> call \<longrightarrow> ?R154 a lista data y ya rv rv' rva s)\<rbrace>
 4. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> ?Q'155 a lista data y ya rv rv' rv'a s) \<and> (\<not> call \<longrightarrow> ?R'156 a lista data y ya rv rv' rv'a s)\<rbrace>
 5. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 6. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 7. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 8. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>a lista data. \<lbrakk>bl; call\<rbrakk> \<Longrightarrow> corres dc (?Q153 a lista data () () () () ()) (?Q'155 a lista data () () () () ()) (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive) (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t)
 2. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a; \<not> call; \<not> call\<rbrakk> \<Longrightarrow> corres dc (?R154 a lista data y ya rv rv' rva) (?R'156 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 3. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. (call \<longrightarrow> ?Q153 a lista data y ya rv rv' rva s) \<and> (\<not> call \<longrightarrow> ?R154 a lista data y ya rv rv' rva s)\<rbrace>
 4. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> ?Q'155 a lista data y ya rv rv' rv'a s) \<and> (\<not> call \<longrightarrow> ?R'156 a lista data y ya rv rv' rv'a s)\<rbrace>
 5. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 6. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 7. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 8. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>a lista data. \<lbrakk>bl; call; cg \<or> cgr\<rbrakk> \<Longrightarrow> corres dc (?P168 a lista data () () () () ()) (?P'166 a lista data () () () () ()) (setup_caller_cap t a (receiver_can_grant data)) (setupCallerCap t a (receiver_can_grant data))
 2. \<And>a lista data. \<lbrakk>bl; call; \<not> (cg \<or> cgr)\<rbrakk> \<Longrightarrow> corres dc (?Q167 a lista data () () () () ()) (?Q'165 a lista data () () () () ()) (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 3. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a; \<not> call; \<not> call\<rbrakk> \<Longrightarrow> corres dc (?R154 a lista data y ya rv rv' rva) (?R'156 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 4. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. (call \<longrightarrow> (if cg \<or> cgr then ?P168 a lista data y ya rv rv' rva else ?Q167 a lista data y ya rv rv' rva) s) \<and> (\<not> call \<longrightarrow> ?R154 a lista data y ya rv rv' rva s)\<rbrace>
 5. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> (if cg \<or> cgr then ?P'166 a lista data y ya rv rv' rv'a else ?Q'165 a lista data y ya rv rv' rv'a) s) \<and> (\<not> call \<longrightarrow> ?R'156 a lista data y ya rv rv' rv'a s)\<rbrace>
 6. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 7. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 8. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 9. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>a lista data. \<lbrakk>bl; call; \<not> (cg \<or> cgr)\<rbrakk> \<Longrightarrow> corres dc (?Q167 a lista data () () () () ()) (?Q'165 a lista data () () () () ()) (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 2. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a; \<not> call; \<not> call\<rbrakk> \<Longrightarrow> corres dc (?R154 a lista data y ya rv rv' rva) (?R'156 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 3. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. (call \<longrightarrow> (if cg \<or> cgr then st_tcb_at (Not \<circ> halted) t and tcb_at a and st_tcb_at (Not \<circ> awaiting_reply) t and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 3) else ?Q167 a lista data y ya rv rv' rva) s) \<and> (\<not> call \<longrightarrow> ?R154 a lista data y ya rv rv' rva s)\<rbrace>
 4. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> (if cg \<or> cgr then tcb_at' t and tcb_at' a and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else ?Q'165 a lista data y ya rv rv' rv'a) s) \<and> (\<not> call \<longrightarrow> ?R'156 a lista data y ya rv rv' rv'a s)\<rbrace>
 5. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 6. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 7. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 8. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a; \<not> call; \<not> call\<rbrakk> \<Longrightarrow> corres dc (?R154 a lista data y ya rv rv' rva) (?R'156 a lista data y ya rv rv' rv'a) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 2. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. (call \<longrightarrow> (if cg \<or> cgr then st_tcb_at (Not \<circ> halted) t and tcb_at a and st_tcb_at (Not \<circ> awaiting_reply) t and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 3) else tcb_at t) s) \<and> (\<not> call \<longrightarrow> ?R154 a lista data y ya rv rv' rva s)\<rbrace>
 3. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> (if cg \<or> cgr then tcb_at' t and tcb_at' a and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' t) s) \<and> (\<not> call \<longrightarrow> ?R'156 a lista data y ya rv rv' rv'a s)\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 5. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 6. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 7. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a lista data y ya rv rv' rva rv'a. \<lbrakk>bl; dc y ya; dc rv rv'; dc rva rv'a; \<not> call; \<not> call\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. True) (\<lambda>s. True) (when call (if cg \<or> cgr then setup_caller_cap t a (receiver_can_grant data) else set_thread_state t Structures_A.thread_state.Inactive)) (when call (if cg \<or> cgr then setupCallerCap t a (receiver_can_grant data) else setThreadState Structures_H.thread_state.Inactive t))
 2. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. (call \<longrightarrow> (if cg \<or> cgr then st_tcb_at (Not \<circ> halted) t and tcb_at a and st_tcb_at (Not \<circ> awaiting_reply) t and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 3) else tcb_at t) s) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 3. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> (if cg \<or> cgr then tcb_at' t and tcb_at' a and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' t) s) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 5. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 6. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 7. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q143 a lista data y ya rv\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. (call \<longrightarrow> (if cg \<or> cgr then st_tcb_at (Not \<circ> halted) t and tcb_at a and st_tcb_at (Not \<circ> awaiting_reply) t and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 3) else tcb_at t) s) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 2. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> (if cg \<or> cgr then tcb_at' t and tcb_at' a and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' t) s) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 3. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 5. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 6. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q143 a lista data () () ()\<rbrace> possible_switch_to a \<lbrace>\<lambda>rva s. call \<longrightarrow> (cg \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at a s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_objs s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 3) s) \<and> (cgr \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at a s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_objs s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, tcb_cnode_index 3) s) \<and> (\<not> cg \<and> \<not> cgr \<longrightarrow> tcb_at t s)\<rbrace>
 2. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> (if cg \<or> cgr then tcb_at' t and tcb_at' a and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' t) s) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 3. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and ?Q143 a lista data y ya rv\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 5. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 6. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 10. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a lista data y ya rv rv'. \<lbrakk>bl; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'146 a lista data y ya rv'\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. (call \<longrightarrow> (if cg \<or> cgr then tcb_at' t and tcb_at' a and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' t) s) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 2. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and (\<lambda>b. (st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> valid_reply_caps b \<and> valid_objs b \<and> pspace_distinct b \<and> pspace_aligned b \<and> valid_mdb b \<and> valid_list b \<and> valid_reply_masters b \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) b) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> valid_reply_caps b \<and> valid_objs b \<and> pspace_distinct b \<and> pspace_aligned b \<and> valid_mdb b \<and> valid_list b \<and> valid_reply_masters b \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) b) \<and> tcb_at t b)\<rbrace>
 3. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 4. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 5. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 10. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'146 a lista data () () ()\<rbrace> possibleSwitchTo a \<lbrace>\<lambda>rv'a s. call \<longrightarrow> (cg \<longrightarrow> tcb_at' t s \<and> tcb_at' a s \<and> valid_pspace' s \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (cgr \<longrightarrow> tcb_at' t s \<and> tcb_at' a s \<and> valid_pspace' s \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<not> cg \<and> \<not> cgr \<longrightarrow> tcb_at' t s)\<rbrace>
 2. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and (\<lambda>b. (st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> valid_reply_caps b \<and> valid_objs b \<and> pspace_distinct b \<and> pspace_aligned b \<and> valid_mdb b \<and> valid_list b \<and> valid_reply_masters b \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) b) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> valid_reply_caps b \<and> valid_objs b \<and> pspace_distinct b \<and> pspace_aligned b \<and> valid_mdb b \<and> valid_list b \<and> valid_reply_masters b \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) b) \<and> tcb_at t b)\<rbrace>
 3. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and ?Q'146 a lista data y ya rv'\<rbrace>
 4. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 5. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 9. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 10. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q133 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a and (\<lambda>b. (st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> valid_reply_caps b \<and> valid_objs b \<and> pspace_distinct b \<and> pspace_aligned b \<and> valid_mdb b \<and> valid_list b \<and> valid_reply_masters b \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) b) \<and> (st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> valid_reply_caps b \<and> valid_objs b \<and> pspace_distinct b \<and> pspace_aligned b \<and> valid_mdb b \<and> valid_list b \<and> valid_reply_masters b \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) b) \<and> tcb_at t b)\<rbrace>
 2. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and (\<lambda>b. (tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' runnable' a b) \<and> (tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' runnable' a b) \<and> tcb_at' t b)\<rbrace>
 3. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q133 a lista data y\<rbrace>
 4. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 9. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 10. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?P'322 a lista data ()\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv s. weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at runnable a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at a s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_objs s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at a s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_objs s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s\<rbrace>
 2. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and (\<lambda>b. (tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' runnable' a b) \<and> (tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' runnable' a b) \<and> tcb_at' t b)\<rbrace>
 3. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and (\<lambda>s. valid_etcbs s \<and> ?P'322 a lista data y s)\<rbrace>
 4. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 8. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 9. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 10. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>bl; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'135 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs' and (\<lambda>b. (tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' runnable' a b) \<and> (tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' runnable' a b) \<and> tcb_at' t b)\<rbrace>
 2. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and (\<lambda>s. valid_etcbs s \<and> (weak_valid_sched_action and (\<lambda>s. runnable Structures_A.thread_state.Running)) s \<and> cur_tcb s \<and> ((a = a \<longrightarrow> runnable Structures_A.thread_state.Running) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at runnable a s)) \<and> ((a = t \<longrightarrow> \<not> halted Structures_A.thread_state.Running) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s)) \<and> tcb_at a s \<and> ((a = t \<longrightarrow> Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s)) \<and> (valid_reply_caps s \<and> (Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply \<longrightarrow> \<not> has_reply_cap a s)) \<and> (valid_objs and valid_tcb_state Structures_A.thread_state.Running and (\<lambda>s. (\<forall>aa data. Structures_A.thread_state.Running = Structures_A.thread_state.BlockedOnReceive aa data \<longrightarrow> cte_wp_at ((=) cap.NullCap) (a, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) a s \<or> halted Structures_A.thread_state.Running \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) s))) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> ((a = t \<longrightarrow> \<not> halted Structures_A.thread_state.Running) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s)) \<and> tcb_at a s \<and> ((a = t \<longrightarrow> Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s)) \<and> (valid_reply_caps s \<and> (Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply \<longrightarrow> \<not> has_reply_cap a s)) \<and> (valid_objs and valid_tcb_state Structures_A.thread_state.Running and (\<lambda>s. (\<forall>aa data. Structures_A.thread_state.Running = Structures_A.thread_state.BlockedOnReceive aa data \<longrightarrow> cte_wp_at ((=) cap.NullCap) (a, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) a s \<or> halted Structures_A.thread_state.Running \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) s))) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s)\<rbrace>
 3. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'135 a lista data ya\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 7. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 8. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 9. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 10. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and (\<lambda>s. valid_etcbs s \<and> (weak_valid_sched_action and (\<lambda>s. runnable Structures_A.thread_state.Running)) s \<and> cur_tcb s \<and> ((a = a \<longrightarrow> runnable Structures_A.thread_state.Running) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at runnable a s)) \<and> ((a = t \<longrightarrow> \<not> halted Structures_A.thread_state.Running) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s)) \<and> tcb_at a s \<and> ((a = t \<longrightarrow> Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s)) \<and> (valid_reply_caps s \<and> (Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply \<longrightarrow> \<not> has_reply_cap a s)) \<and> (valid_objs and valid_tcb_state Structures_A.thread_state.Running and (\<lambda>s. (\<forall>aa data. Structures_A.thread_state.Running = Structures_A.thread_state.BlockedOnReceive aa data \<longrightarrow> cte_wp_at ((=) cap.NullCap) (a, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) a s \<or> halted Structures_A.thread_state.Running \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) s))) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> ((a = t \<longrightarrow> \<not> halted Structures_A.thread_state.Running) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s)) \<and> tcb_at a s \<and> ((a = t \<longrightarrow> Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply) \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s)) \<and> (valid_reply_caps s \<and> (Structures_A.thread_state.Running \<noteq> Structures_A.thread_state.BlockedOnReply \<longrightarrow> \<not> has_reply_cap a s)) \<and> (valid_objs and valid_tcb_state Structures_A.thread_state.Running and (\<lambda>s. (\<forall>aa data. Structures_A.thread_state.Running = Structures_A.thread_state.BlockedOnReceive aa data \<longrightarrow> cte_wp_at ((=) cap.NullCap) (a, tcb_cnode_index 3) s) \<and> (st_tcb_at (\<lambda>st. \<not> halted st) a s \<or> halted Structures_A.thread_state.Running \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) s))) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s)\<rbrace>
 2. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 7. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 8. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 9. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 10. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y x. tcb_at a x \<and> valid_etcbs x \<and> weak_valid_sched_action x \<and> cur_tcb x \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t x) \<and> tcb_at a x \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t x) \<and> valid_reply_caps x \<and> \<not> has_reply_cap a x \<and> valid_objs x \<and> (st_tcb_at (\<lambda>st. \<not> halted st) a x \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) x) \<and> pspace_distinct x \<and> pspace_aligned x \<and> valid_mdb x \<and> valid_list x \<and> valid_reply_masters x \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) x \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t x) \<and> tcb_at a x \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t x) \<and> valid_reply_caps x \<and> \<not> has_reply_cap a x \<and> valid_objs x \<and> (st_tcb_at (\<lambda>st. \<not> halted st) a x \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) x) \<and> pspace_distinct x \<and> pspace_aligned x \<and> valid_mdb x \<and> valid_list x \<and> valid_reply_masters x \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) x \<and> tcb_at t x\<rbrace>
 2. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 7. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 8. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 9. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 10. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q126 a lista (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>r s. tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s) \<and> tcb_at a s \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s) \<and> valid_reply_caps s \<and> (valid_reply_caps s \<and> st_tcb_at (Not \<circ> awaiting_reply) a s) \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. \<not> halted a) t s) \<and> tcb_at a s \<and> (a \<noteq> t \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s) \<and> valid_reply_caps s \<and> (valid_reply_caps s \<and> st_tcb_at (Not \<circ> awaiting_reply) a s) \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = a) (a, tcb_cnode_index 2) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s\<rbrace>
 2. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q126 a lista recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 6. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 7. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 8. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 9. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 10. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and tcb_at' a and valid_tcb_state' Structures_H.thread_state.Running) s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> tcb_at' t s)\<rbrace>
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> tcb_at t b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 6. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 7. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya x. tcb_at' a x \<and> Invariants_H.valid_queues x \<and> valid_queues' x \<and> weak_sch_act_wf (ksSchedulerAction x) x \<and> cur_tcb' x \<and> tcb_at' a x \<and> valid_tcb_state' Structures_H.thread_state.Running x \<and> valid_objs' x \<and> tcb_at' t x \<and> tcb_at' a x \<and> valid_pspace' x \<and> tcb_at' a x \<and> valid_tcb_state' Structures_H.thread_state.Running x \<and> weak_sch_act_wf (ksSchedulerAction x) x \<and> tcb_at' a x \<and> tcb_at' t x \<and> tcb_at' a x \<and> valid_pspace' x \<and> tcb_at' a x \<and> valid_tcb_state' Structures_H.thread_state.Running x \<and> weak_sch_act_wf (ksSchedulerAction x) x \<and> tcb_at' a x \<and> tcb_at' t x\<rbrace>
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> tcb_at t b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 6. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 7. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>r s. tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> valid_objs' s \<and> tcb_at' t s \<and> tcb_at' a s \<and> valid_pspace' s \<and> tcb_at' a s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> valid_pspace' s \<and> tcb_at' a s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s\<rbrace>
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> tcb_at t b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 6. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 7. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista data. bl \<Longrightarrow> \<lbrace>?Q'125 a lista (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>r s. tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> valid_objs' s \<and> tcb_at' t s \<and> tcb_at' a s \<and> valid_pspace' s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> valid_pspace' s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s\<rbrace>
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> tcb_at t b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'125 a lista b\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 5. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 6. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 7. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 8. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 9. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q106 a lista ()\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> st_tcb_at (\<lambda>a. \<not> halted a) t b \<and> tcb_at a b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> st_tcb_at (Not \<circ> awaiting_reply) a b \<and> (valid_objs and valid_mdb) b \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) b \<and> pspace_distinct b \<and> pspace_aligned b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) b \<and> tcb_at t b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'105 a lista ()\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b)\<rbrace>
 3. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q91 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at a and ?Q106 a lista b\<rbrace>
 4. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and ?Q'105 a lista b\<rbrace>
 5. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q91 a lista) s
 6. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 7. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 8. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 9. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 10. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> \<lbrace>?P'919 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>rv s. (case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at a s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) s \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) s \<and> st_tcb_at (Not \<circ> awaiting_reply) a s \<and> (valid_objs and valid_mdb) s \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) s \<and> valid_list s \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) s \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> tcb_at a s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) s \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) s \<and> st_tcb_at (Not \<circ> awaiting_reply) a s \<and> (valid_objs and valid_mdb) s \<and> (valid_objs and cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) and tcb_at a) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) s \<and> valid_list s \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) s \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) and tcb_at a) s \<and> tcb_at t s) \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnReceive ep data) a s\<rbrace>
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and (tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b))\<rbrace>
 3. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ?P'919 a lista s)) s
 4. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 5. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 6. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 7. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 8. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 9. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (9 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> \<lbrace>?P'919 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>rv s. ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_objs s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_list s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnReceive ep data) a s\<rbrace>
 2. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and (tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b))\<rbrace>
 3. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ?P'919 a lista s)) s
 4. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 5. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 6. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 7. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 8. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 9. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (8 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b. tcb_at' a and (tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' a b \<and> tcb_at' t b))\<rbrace>
 2. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_list s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnReceive ep data) a s)) s
 3. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 4. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 5. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 7. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 8. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (8 subgoals):
 1. \<And>a lista. bl \<Longrightarrow> \<lbrace>?Q'91 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>b c. tcb_at' a c \<and> tcb_at' t c \<and> tcb_at' a c \<and> valid_pspace' c \<and> cur_tcb' c \<and> ep_at' ep c \<and> tcb_at' a c \<and> Invariants_H.valid_queues c \<and> valid_queues' c \<and> sch_act_wf (ksSchedulerAction c) c \<and> cur_tcb' c \<and> tcb_at' a c \<and> valid_objs' c \<and> valid_mdb' c \<and> tcb_at' t c \<and> tcb_at' a c \<and> valid_pspace' c \<and> tcb_at' a c \<and> sch_act_wf (ksSchedulerAction c) c \<and> tcb_at' a c \<and> tcb_at' t c \<and> tcb_at' a c \<and> valid_pspace' c \<and> tcb_at' a c \<and> sch_act_wf (ksSchedulerAction c) c \<and> tcb_at' a c \<and> tcb_at' t c\<rbrace>
 2. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_list s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnReceive ep data) a s)) s
 3. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'91 a lista) s
 4. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 5. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 7. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 8. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>a lista s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_list s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> tcb_at t s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnReceive ep data) a s)) s
 2. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s)) s
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>a lista s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; tcb_at a s; \<forall>t\<in>set lista. tcb_at t s; a \<notin> set lista; distinct lista; obj_at (\<lambda>ob. ob = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep s; ex_nonz_cap_to t s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnReceive ep data) a s
 2. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s)) s
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>a lista s. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; tcb_at a s; \<forall>t\<in>set lista. tcb_at t s; a \<notin> set lista; distinct lista; ex_nonz_cap_to t s; \<exists>ko. ko = Endpoint (Structures_A.endpoint.RecvEP (a # lista)) \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> st_tcb_at (\<lambda>a. \<not> halted a) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) t s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> cte_wp_at (\<lambda>b. is_master_reply_cap b \<and> obj_ref_of b = a) (a, tcb_cnode_index 2) s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnReceive ep data) a s
 2. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s)) s
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (7 subgoals):
 1. \<And>a lista s tcb tcba pl. \<lbrakk>bl; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; ep_at ep s; tcb_at a s; \<forall>t\<in>set lista. tcb_at t s; a \<notin> set lista; distinct lista; ex_nonz_cap_to t s; valid_etcbs s; state_refs_of s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); get_tcb t s = Some tcb; active (tcb_state tcb); DetSchedInvs_AI.valid_queues s; \<forall>x\<in>set lista. \<exists>tcb. get_tcb x s = Some tcb \<and> (\<exists>pl. tcb_state tcb = Structures_A.thread_state.BlockedOnReceive ep pl); ct_not_in_q s; get_tcb a s = Some tcba; tcb_state tcba = Structures_A.thread_state.BlockedOnReceive ep pl; is_activatable (cur_thread s) s; weak_valid_sched_action s; switch_in_cur_domain s; ct_in_cur_domain s; valid_blocked s; valid_idle_etcb s\<rbrakk> \<Longrightarrow> \<not> halted (tcb_state tcb) \<and> tcb_state tcb \<noteq> Structures_A.thread_state.BlockedOnReply \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, tcb_cnode_index 3) s
 2. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s)) s
 3. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 4. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 6. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 7. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (6 subgoals):
 1. \<And>a lista s. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> tcb_at' a s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a s \<and> tcb_at' t s)) s
 2. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 3. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 5. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 6. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bl; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a_ # lista_))) s_\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a_ s \<and> tcb_at' t s \<and> tcb_at' a_ s \<and> (valid_pspace' and valid_ep' (case lista_ of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista_)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a_ s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a_ s \<and> (valid_objs' and valid_ep' (case lista_ of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista_)) s \<and> valid_mdb' s \<and> tcb_at' t s \<and> tcb_at' a_ s \<and> (valid_pspace' and valid_ep' (case lista_ of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista_)) s \<and> tcb_at' a_ s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a_ s \<and> tcb_at' t s \<and> tcb_at' a_ s \<and> (valid_pspace' and valid_ep' (case lista_ of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista_)) s \<and> tcb_at' a_ s \<and> sch_act_wf (ksSchedulerAction s) s \<and> tcb_at' a_ s \<and> tcb_at' t s)) s_ proof (prove)
goal (5 subgoals):
 1. bl \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>ob. ob = Endpoint rv) ep and ex_nonz_cap_to t\<rbrace>
 2. bl \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 3. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q12) s
 4. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'12) s
 5. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>bl; (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. (einvs and st_tcb_at active t and ep_at ep) s \<and> (invs and ep_at ep) s \<and> obj_at (\<lambda>ko. partial_inv Endpoint ko \<noteq> None) ep s \<and> ex_nonz_cap_to t s)) s
 2. \<And>s. \<lbrakk>bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. (invs' and tcb_at' t and sch_act_not t and ep_at' ep) s \<and> (invs' and ep_at' ep) s)) s
 3. \<lbrakk>call \<longrightarrow> bl; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (do epa <- get_endpoint ep;
case (epa, bl) of (Structures_A.endpoint.IdleEP, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP [t]
od | (Structures_A.endpoint.IdleEP, False) \<Rightarrow> return () | (Structures_A.endpoint.SendEP queue, True) \<Rightarrow> do set_thread_state t (Structures_A.thread_state.BlockedOnSend ep \<lparr>sender_badge = bg, sender_can_grant = cg, sender_can_grant_reply = cgr, sender_is_call = call\<rparr>);
set_endpoint ep $ Structures_A.endpoint.SendEP (queue @ [t])
od | (Structures_A.endpoint.SendEP queue, False) \<Rightarrow> return () | (Structures_A.endpoint.RecvEP [], x) \<Rightarrow> fail | (Structures_A.endpoint.RecvEP (dest # queue), x) \<Rightarrow> do set_endpoint ep $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Structures_A.thread_state.Running;
do_extended_op (possible_switch_to dest);
when call $ if cg \<or> cgr then setup_caller_cap t dest reply_can_grant else set_thread_state t Structures_A.thread_state.Inactive
od
od) (do epa <- getEndpoint ep;
case epa of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint ep $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer t (Just ep) bg cg dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (call, cg \<or> cgr) of (True, True) \<Rightarrow> setupCallerCap t dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive t | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP [t]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if bl then do setThreadState (Structures_H.thread_state.BlockedOnSend ep bg cg cgr call) t;
setEndpoint ep $ Structures_H.endpoint.SendEP $ queue @ [t]
od else return ()
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (get_endpoint ep >>= Structures_A.endpoint.case_endpoint (return ()) (\<lambda>queue. return ()) (case_list fail (\<lambda>dest queue. do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od))) (getEndpoint ep >>= Structures_H.endpoint.case_endpoint (case_list fail (\<lambda>dest queue. do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)) (return ()) (\<lambda>queue. return ())) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> corres dc ?Q1207 ?Q'1207 (get_endpoint ep >>= Structures_A.endpoint.case_endpoint (return ()) (\<lambda>queue. return ()) (case_list fail (\<lambda>dest queue. do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od))) (getEndpoint ep >>= Structures_H.endpoint.case_endpoint (case_list fail (\<lambda>dest queue. do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)) (return ()) (\<lambda>queue. return ()))
 2. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> ?Q1207 s
 3. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> ?Q'1207 s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv'. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv'. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (7 subgoals):
 1. \<And>rv rv'. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'; rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 2. \<And>rv rv' x2. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 3. \<And>rv rv' x3. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 5. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 7. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' x2. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 2. \<And>rv rv' x3. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' x3. \<lbrakk>\<not> call; \<not> bl; ep_relation rv rv'; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv') (case rv of Structures_A.endpoint.RecvEP [] \<Rightarrow> fail | Structures_A.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.endpoint.RecvEP [] \<Rightarrow> fail | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od | _ \<Rightarrow> return ())
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' x3. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP x3; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP x3)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' list. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' list s s'. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; (s, s') \<in> state_relation; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) s; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) s'\<rbrakk> \<Longrightarrow> list \<noteq> []
 2. \<And>rv rv' list. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' list. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' list. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = []\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 2. \<And>rv rv' list a lista. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' list a lista. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' list a lista s s'. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista; (s, s') \<in> state_relation; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) s; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) s'\<rbrakk> \<Longrightarrow> a \<noteq> t
 2. \<And>rv rv' list a lista. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>lista s s'. \<lbrakk>\<not> call; \<not> bl; (s, s') \<in> state_relation; valid_objs s; invs' s'; pspace_aligned s; tcb_at' t s'; pspace_distinct s; sch_act_not t s'; if_live_then_nonz_cap s; ep_at' ep s'; valid_ep' (Structures_H.endpoint.RecvEP (t # lista)) s'; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; valid_ep (Structures_A.endpoint.RecvEP (t # lista)) s; obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (t # lista))) ep s\<rbrakk> \<Longrightarrow> False
 2. \<And>rv rv' list a lista. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>lista s s'. \<lbrakk>\<not> call; \<not> bl; (s, s') \<in> state_relation; valid_objs s; invs' s'; pspace_aligned s; tcb_at' t s'; pspace_distinct s; sch_act_not t s'; if_live_then_nonz_cap s; ep_at' ep s'; valid_ep' (Structures_H.endpoint.RecvEP (t # lista)) s'; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; valid_ep (Structures_A.endpoint.RecvEP (t # lista)) s; \<exists>ko. ko = Endpoint (Structures_A.endpoint.RecvEP (t # lista)) \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> False
 2. \<And>rv rv' list a lista. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>lista s s' koa tcb. \<lbrakk>\<not> call; \<not> bl; (s, s') \<in> state_relation; valid_objs s; invs' s'; pspace_aligned s; tcb_at' t s'; pspace_distinct s; sch_act_not t s'; if_live_then_nonz_cap s; ep_at' ep s'; valid_ep' (Structures_H.endpoint.RecvEP (t # lista)) s'; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; valid_ep (Structures_A.endpoint.RecvEP (t # lista)) s; state_refs_of s ep = insert (t, EPRecv) (set lista \<times> {EPRecv}); kheap s ep = Some koa; is_ep koa; \<forall>x\<in>set lista. \<exists>ko. kheap s x = Some ko \<and> (ep, TCBBlockedRecv) \<in> refs_of ko; active (tcb_state tcb); kheap s t = Some (TCB tcb); (ep, TCBBlockedRecv) \<in> tcb_st_refs_of (tcb_state tcb)\<rbrakk> \<Longrightarrow> False
 2. \<And>rv rv' list a lista. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' list a lista. \<lbrakk>\<not> call; \<not> bl; rv' = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; list \<noteq> []; list = a # lista; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP list)) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP list)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint ep (case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Structures_A.thread_state.Running;
possible_switch_to dest
od) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- setEndpoint ep (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue);
recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg dest;
y <- setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest
od)
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) (do y <- set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista);
recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista);
recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (7 subgoals):
 1. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (?Q1293 a lista) (?Q'1293 a lista) (do y <- set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista);
recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista);
recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> ?Q1293 a lista s
 3. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> ?Q'1293 a lista s
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 5. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 7. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (10 subgoals):
 1. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> ep_relation (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R1297 a lista y) (?R'1297 a lista ya) (do recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 3. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>?R1297 a lista\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>?R'1297 a lista\<rbrace>
 5. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 7. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 9. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (9 subgoals):
 1. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R1297 a lista y) (?R'1297 a lista ya) (do recv_state <- get_thread_state a;
reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do recvState <- getThreadState a;
y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>?R1297 a lista\<rbrace>
 3. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>?R'1297 a lista\<rbrace>
 4. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 5. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 6. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 7. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 8. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 9. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (11 subgoals):
 1. \<And>a lista y ya recv_state recvState. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya; thread_state_relation recv_state recvState\<rbrakk> \<Longrightarrow> corres dc (?R1307 a lista y ya recv_state) (?R'1307 a lista y ya recvState) (do reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>?R1307 a lista y ya\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>?R'1307 a lista y ya\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a lista y ya recv_state recvState. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya; thread_state_relation recv_state recvState; \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data\<rbrakk> \<Longrightarrow> corres dc (?P1317 a lista y ya recv_state) (?R'1307 a lista y ya recvState) (do reply_can_grant <- case recv_state of Structures_A.thread_state.BlockedOnReceive x data \<Rightarrow> do do_ipc_transfer t (Some ep) bg cg a;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- assert (isReceive recvState);
y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. ?P1317 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>?R'1307 a lista y ya\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> corres dc (?P1317 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)) (?R'1307 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))) (do y <- do_ipc_transfer t (Some ep) bg cg a;
y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- doIPCTransfer t (Some ep) bg cg a;
y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. ?P1317 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>?R'1307 a lista y ya\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R1323 a lista data y) (?R'1323 a lista data ya) (do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>?R1323 a lista data\<rbrace>
 3. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>?R'1323 a lista data\<rbrace>
 4. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 5. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 6. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 7. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 8. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 9. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 10. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>a lista data y ya rv rv'. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R1332 a lista data y ya rv) (?R'1332 a lista data y ya rv') (possible_switch_to a) (possibleSwitchTo a)
 3. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1335 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R1332 a lista data y ya\<rbrace>
 4. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1337 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'1332 a lista data y ya\<rbrace>
 5. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q1335 a lista data y\<rbrace>
 6. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1337 a lista data ya\<rbrace>
 7. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 8. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 9. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 10. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a lista data y ya rv rv'. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya; dc rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R1332 a lista data y ya rv) (?R'1332 a lista data y ya rv') (possible_switch_to a) (possibleSwitchTo a)
 2. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1335 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R1332 a lista data y ya\<rbrace>
 3. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1337 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'1332 a lista data y ya\<rbrace>
 4. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q1335 a lista data y\<rbrace>
 5. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1337 a lista data ya\<rbrace>
 6. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 7. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 8. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 9. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 10. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1335 a lista data y\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a\<rbrace>
 2. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1337 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs'\<rbrace>
 3. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q1335 a lista data y\<rbrace>
 4. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1337 a lista data ya\<rbrace>
 5. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 6. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 7. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 8. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 9. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 10. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1335 a lista data ()\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rv. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a\<rbrace>
 2. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1337 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs'\<rbrace>
 3. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and ?Q1335 a lista data y\<rbrace>
 4. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1337 a lista data ya\<rbrace>
 5. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 6. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 7. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 8. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 9. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 10. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a lista data y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1337 a lista data ya\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs'\<rbrace>
 2. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and (\<lambda>b. valid_etcbs b \<and> (weak_valid_sched_action and (\<lambda>s. runnable Structures_A.thread_state.Running)) b \<and> cur_tcb b \<and> (a = a \<longrightarrow> runnable Structures_A.thread_state.Running) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at runnable a b))\<rbrace>
 3. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1337 a lista data ya\<rbrace>
 4. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 5. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 6. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 7. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 8. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 9. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 10. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y. tcb_at a and (\<lambda>b. valid_etcbs b \<and> (weak_valid_sched_action and (\<lambda>s. runnable Structures_A.thread_state.Running)) b \<and> cur_tcb b \<and> (a = a \<longrightarrow> runnable Structures_A.thread_state.Running) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at runnable a b))\<rbrace>
 2. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s)\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 4. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 6. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 8. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 10. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1328 a lista () () (Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace> do_ipc_transfer t (Some ep) bg cg a \<lbrace>\<lambda>y x. tcb_at a x \<and> valid_etcbs x \<and> weak_valid_sched_action x \<and> cur_tcb x\<rbrace>
 2. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s)\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q1328 a lista y ya recv_state and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 4. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 6. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 8. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 10. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s)\<rbrace>
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>ya x. tcb_at' a x \<and> Invariants_H.valid_queues x \<and> valid_queues' x \<and> weak_sch_act_wf (ksSchedulerAction x) x \<and> cur_tcb' x \<and> tcb_at' a x \<and> valid_objs' x\<rbrace>
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a lista data. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1327 a lista () () (Structures_H.thread_state.BlockedOnReceive ep (receiver_can_grant data))\<rbrace> doIPCTransfer t (Some ep) bg cg a \<lbrace>\<lambda>r s. tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> valid_objs' s\<rbrace>
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 3. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'1327 a lista y ya b\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 5. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 7. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 9. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>recv_state. tcb_at t and tcb_at a and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. tcb_at a b \<and> valid_etcbs b \<and> weak_valid_sched_action b \<and> cur_tcb b) and (\<lambda>s. \<exists>data. recv_state = Structures_A.thread_state.BlockedOnReceive ep data)\<rbrace>
 2. \<And>a lista y ya. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1312 a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b)\<rbrace>
 3. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q1297 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>y. tcb_at a and ?Q1310 a lista y\<rbrace>
 4. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'1312 a lista ya\<rbrace>
 5. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1297 a lista) s
 6. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 7. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 8. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 9. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 10. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (8 subgoals):
 1. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?P'1501 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>rv s. (case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s) \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s\<rbrace>
 2. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b))\<rbrace>
 3. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ?P'1501 a lista s)) s
 4. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 5. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 6. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 7. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 8. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (8 subgoals):
 1. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?P'1501 a lista\<rbrace> set_endpoint ep (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista) \<lbrace>\<lambda>rv s. ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s\<rbrace>
 2. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b))\<rbrace>
 3. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ?P'1501 a lista s)) s
 4. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 5. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 6. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 7. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 8. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (7 subgoals):
 1. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (tcb_at' t and tcb_at' a and valid_pspace' and cur_tcb' and (\<lambda>s. case Some ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> (valid_objs' and valid_mdb') b))\<rbrace>
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s)) s
 3. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 5. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 7. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (7 subgoals):
 1. \<And>a lista. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1297 a lista\<rbrace> setEndpoint ep (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>b. tcb_at' t b \<and> tcb_at' a b \<and> valid_pspace' b \<and> cur_tcb' b \<and> ep_at' ep b \<and> tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> cur_tcb' b \<and> tcb_at' a b \<and> valid_objs' b \<and> valid_mdb' b)\<rbrace>
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s)) s
 3. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1297 a lista) s
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 5. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 7. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (einvs and st_tcb_at active t and ep_at ep and valid_ep (Structures_A.endpoint.RecvEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. tcb_at a s \<and> tcb_at t s \<and> tcb_at a s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.RecvEP lista)))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at ep s \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> cur_tcb s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s)) s
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s)) s
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; valid_ep (Structures_A.endpoint.RecvEP (a # lista)) s; obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep s\<rbrakk> \<Longrightarrow> tcb_at a s \<and> distinct lista \<and> (\<forall>t\<in>set lista. tcb_at t s) \<and> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s)) s
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP (a # lista))) ep s; tcb_at a s; \<forall>t\<in>set lista. tcb_at t s; a \<notin> set lista; distinct lista\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s)) s
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; tcb_at a s; \<forall>t\<in>set lista. tcb_at t s; a \<notin> set lista; distinct lista; \<exists>ko. ko = Endpoint (Structures_A.endpoint.RecvEP (a # lista)) \<and> state_refs_of s ep = refs_of ko \<and> (\<forall>(x, tp)\<in>refs_of ko. obj_at (\<lambda>ko. (ep, symreftype tp) \<in> refs_of ko) x s)\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnReceive ep data) a s
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s)) s
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (6 subgoals):
 1. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; valid_list s; valid_sched s; st_tcb_at active t s; ep_at ep s; tcb_at a s; \<forall>t\<in>set lista. tcb_at t s; a \<notin> set lista; distinct lista; state_refs_of s ep = insert (a, EPRecv) (set lista \<times> {EPRecv}); st_tcb_at (\<lambda>ts. \<exists>pl. ts = Structures_A.thread_state.BlockedOnReceive ep pl) a s; \<forall>x\<in>set lista. st_tcb_at (\<lambda>ts. \<exists>pl. ts = Structures_A.thread_state.BlockedOnReceive ep pl) x s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> weak_valid_sched_action s
 2. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s)) s
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 4. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 6. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (5 subgoals):
 1. \<And>a lista s. \<lbrakk>\<not> call; \<not> bl; a \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a s \<and> tcb_at' t s \<and> tcb_at' a s \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista)) s \<and> valid_mdb' s)) s
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 3. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 5. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> call; \<not> bl; a_ \<noteq> t; (invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' (Structures_H.endpoint.RecvEP (a_ # lista_))) s_\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. tcb_at' a_ s \<and> tcb_at' t s \<and> tcb_at' a_ s \<and> (valid_pspace' and valid_ep' (case lista_ of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista_)) s \<and> cur_tcb' s \<and> ep_at' ep s \<and> tcb_at' a_ s \<and> Invariants_H.valid_queues s \<and> valid_queues' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a_ s \<and> (valid_objs' and valid_ep' (case lista_ of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP lista_)) s \<and> valid_mdb' s)) s_ proof (prove)
goal (4 subgoals):
 1. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q1211\<rbrace> get_endpoint ep \<lbrace>\<lambda>rv. einvs and st_tcb_at active t and ep_at ep and valid_ep rv and obj_at (\<lambda>k. k = Endpoint rv) ep\<rbrace>
 2. \<lbrakk>\<not> call; \<not> bl\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1211\<rbrace> getEndpoint ep \<lbrace>\<lambda>rv'. invs' and tcb_at' t and sch_act_not t and ep_at' ep and valid_ep' rv'\<rbrace>
 3. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and ?Q1211) s
 4. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and ?Q'1211) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<not> call; \<not> bl; (einvs and st_tcb_at active t and obj_at (\<lambda>ko. \<exists>y. Endpoint y = ko) ep and ex_nonz_cap_to t) s\<rbrakk> \<Longrightarrow> (ep_at ep and (\<lambda>s. (einvs and st_tcb_at active t and ep_at ep) s \<and> (invs and ep_at ep) s \<and> obj_at (\<lambda>ko. partial_inv Endpoint ko \<noteq> None) ep s)) s
 2. \<And>s. \<lbrakk>\<not> call; \<not> bl; (invs' and sch_act_not t and tcb_at' t and ep_at' ep) s\<rbrakk> \<Longrightarrow> (ep_at' ep and (\<lambda>s. (invs' and tcb_at' t and sch_act_not t and ep_at' ep) s \<and> (invs' and ep_at' ep) s)) s proof (prove)
goal:
No subgoals! proof (state)
this:
corres dc (einvs and st_tcb_at active t and ep_at ep and ex_nonz_cap_to t) (invs' and sch_act_not t and tcb_at' t and ep_at' ep) (send_ipc bl call bg cg cgr t ep) (sendIPC bl call bg cg cgr t ep)

goal:
No subgoals!