theory Finalise_DR

lemma finalise_cancel_ipc:
  "dcorres dc \<top> (not_idle_thread ptr and invs and valid_etcbs)
    (CSpace_D.cancel_ipc ptr)
    (cancel_ipc ptr)" apply (simp add:CSpace_D.cancel_ipc_def cancel_ipc_def get_thread_state_def thread_get_def) apply (rule dcorres_gets_the) apply (simp add:opt_object_tcb not_idle_thread_def transform_tcb_def, clarsimp) apply (frule(1) valid_etcbs_get_tcb_get_etcb) apply (clarsimp simp: opt_cap_tcb tcb_pending_op_slot_def
                         tcb_caller_slot_def tcb_cspace_slot_def tcb_ipcbuffer_slot_def
                         tcb_replycap_slot_def tcb_vspace_slot_def assert_opt_def) apply (case_tac "tcb_state obj'") apply (simp_all add:not_idle_thread_def infer_tcb_pending_op_def
            tcb_pending_op_slot_def[symmetric] tcb_replycap_slot_def[symmetric]) apply (simp add:blocked_cancel_ipc_def) apply (rule corres_guard_imp) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_dummy_return_pl) apply (rule corres_split[OF corres_dummy_set_sync_ep]) apply clarsimp apply (rule corres_dummy_return_pr) apply (rule corres_split[OF dcorres_revoke_cap_unnecessary]) apply (simp add: when_def dc_def[symmetric]) apply (rule set_thread_state_corres) apply (wp sts_only_idle sts_st_tcb_at' valid_ep_queue_subset
                        | clarsimp simp:not_idle_thread_def a_type_def)+ apply (simp add:get_blocking_object_def | wp)+ apply (clarsimp dest!:get_tcb_rev simp:invs_def ep_at_def2[symmetric, simplified]) apply (frule(1) valid_tcb_if_valid_state) apply (clarsimp simp:valid_tcb_def valid_tcb_state_def
       valid_state_def valid_pspace_def infer_tcb_pending_op_def
       st_tcb_at_def generates_pending_def obj_at_def dest!:get_tcb_SomeD) apply (rule tcb_at_cte_at_2,clarsimp simp:tcb_at_def dest!:get_tcb_rev,simp) apply (simp add:blocked_cancel_ipc_def) apply (rule corres_guard_imp) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_dummy_return_pl) apply (rule corres_split[OF corres_dummy_set_sync_ep]) apply clarsimp apply (rule corres_dummy_return_pr) apply (rule corres_split[OF dcorres_revoke_cap_unnecessary]) unfolding K_bind_def apply (rule set_thread_state_corres) apply (wp sts_only_idle sts_st_tcb_at' valid_ep_queue_subset
                     | clarsimp simp:not_idle_thread_def a_type_def)+ apply (simp add:get_blocking_object_def | wp)+ apply (clarsimp dest!:get_tcb_rev simp:invs_def ep_at_def2[symmetric, simplified]) apply (frule(1) valid_tcb_if_valid_state) apply (clarsimp simp:valid_tcb_def valid_tcb_state_def
           valid_state_def valid_pspace_def infer_tcb_pending_op_def
           st_tcb_at_def generates_pending_def obj_at_def dest!:get_tcb_SomeD) apply (rule tcb_at_cte_at_2,clarsimp simp:tcb_at_def dest!:get_tcb_rev,simp) apply (simp add:reply_cancel_ipc_def) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule thread_set_fault_corres; clarsimp) apply (rule corres_symb_exec_r) apply (simp add: revoke_cap_simple.simps) apply (subst transform_tcb_slot_simp[symmetric]) apply (rule dcorres_revoke_the_cap_corres) apply (wp thread_set_invs_trivial[OF ball_tcb_cap_casesI]
                     thread_set_cte_at|clarsimp)+ apply (clarsimp simp: not_idle_thread_def
      tcb_at_cte_at_2[unfolded tcb_at_def]) apply (simp add:cancel_signal_def) apply (rule corres_guard_imp) apply (rule_tac Q'="\<lambda>r. valid_ntfn r and (=) s'" in corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_dummy_return_pl) apply (rule corres_split[OF corres_dummy_set_notification]) unfolding K_bind_def apply (rule corres_dummy_return_pr) apply (rule corres_split[OF dcorres_revoke_cap_unnecessary]) unfolding K_bind_def apply (rule set_thread_state_corres) including no_pre apply (wpsimp wp: set_simple_ko_valid_objs simp: not_idle_thread_def a_type_def)+ apply (clarsimp simp:valid_def fail_def return_def split:Structures_A.ntfn.splits)+ apply (clarsimp simp:invs_def ntfn_at_def2[symmetric, simplified]) apply (frule(1) valid_tcb_if_valid_state) apply (clarsimp simp:valid_tcb_def tcb_at_cte_at_2
             valid_tcb_state_def invs_def valid_state_def valid_pspace_def
             st_tcb_at_def generates_pending_def obj_at_def infer_tcb_pending_op_def
             dest!:get_tcb_SomeD) apply (simp add:valid_ntfn_after_remove_slot) apply (wp | clarsimp split:Structures_A.ntfn.splits)+ apply (clarsimp simp:invs_def, frule(1) valid_tcb_if_valid_state) apply (clarsimp simp:valid_tcb_def tcb_at_cte_at_2 valid_tcb_state_def invs_def valid_state_def valid_pspace_def
        st_tcb_at_def generates_pending_def obj_at_def dest!:get_tcb_SomeD) apply (clarsimp, frule(1) valid_etcbs_get_tcb_get_etcb) apply (clarsimp simp:opt_object_tcb opt_cap_tcb) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (not_idle_thread ptr and invs and valid_etcbs) (CSpace_D.cancel_ipc ptr) (IpcCancel_A.cancel_ipc ptr) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (not_idle_thread ptr and invs and valid_etcbs) (do cap <- KHeap_D.get_cap (ptr, tcb_pending_op_slot);
case cap of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()
od) (do tcb <- gets_the (get_tcb ptr);
case tcb_state tcb of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state tcb) ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state tcb) ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ()
od) proof (prove)
goal (2 subgoals):
 1. \<And>s s' obj obj'. \<lbrakk>s = transform s'; True; (not_idle_thread ptr and invs and valid_etcbs) s'; get_tcb ptr s' = Some obj'; opt_cap (ptr, tcb_pending_op_slot) s = Some obj\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (case obj of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 2. \<And>s s'. \<lbrakk>s = transform s'; True; (not_idle_thread ptr and invs and valid_etcbs) s'; get_tcb ptr s' \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (ptr, tcb_pending_op_slot) s \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>s' obj obj'. \<lbrakk>get_tcb ptr s' = Some obj'; opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some obj; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case obj of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 2. \<And>s s'. \<lbrakk>s = transform s'; True; (not_idle_thread ptr and invs and valid_etcbs) s'; get_tcb ptr s' \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (ptr, tcb_pending_op_slot) s \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>s' obj obj'. \<lbrakk>get_tcb ptr s' = Some obj'; opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some obj; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; \<exists>etcb. get_etcb ptr s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case obj of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 2. \<And>s s'. \<lbrakk>s = transform s'; True; (not_idle_thread ptr and invs and valid_etcbs) s'; get_tcb ptr s' \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (ptr, tcb_pending_op_slot) s \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 2. \<And>s s'. \<lbrakk>s = transform s'; True; (not_idle_thread ptr and invs and valid_etcbs) s'; get_tcb ptr s' \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (ptr, tcb_pending_op_slot) s \<noteq> None proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = Running\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; inactive (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = Restart\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 4. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 5. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; idle (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (case infer_tcb_pending_op ptr (tcb_state obj') of PendingSyncSendCap x xa xb xc xd xe \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingSyncRecvCap x is_reply xa \<Rightarrow> do when is_reply $ update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot);
when (\<not> is_reply) $ KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | PendingNtfnRecvCap x \<Rightarrow> do revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od | _ \<Rightarrow> return ()) (case tcb_state obj' of BlockedOnReceive x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnSend x y \<Rightarrow> blocked_cancel_ipc (tcb_state obj') ptr | BlockedOnReply \<Rightarrow> reply_cancel_ipc ptr | BlockedOnNotification x \<Rightarrow> cancel_signal ptr x | _ \<Rightarrow> return ())
 9. \<And>s s'. \<lbrakk>s = transform s'; True; (not_idle_thread ptr and invs and valid_etcbs) s'; get_tcb ptr s' \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (ptr, tcb_pending_op_slot) s \<noteq> None proof (prove)
goal (5 subgoals):
 1. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnReceive x41 x42) ptr)
 2. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 5. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (5 subgoals):
 1. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do epptr <- get_blocking_object (BlockedOnReceive x41 x42);
ep <- get_endpoint epptr;
queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 5. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (7 subgoals):
 1. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q18 s' obj' etcb x41 x42) (?Q'18 s' obj' etcb x41 x42) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do epptr <- get_blocking_object (BlockedOnReceive x41 x42);
ep <- get_endpoint epptr;
queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ?Q18 s' obj' etcb x41 x42 s
 3. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> ?Q'18 s' obj' etcb x41 x42 s
 4. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 6. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 7. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q18 s' obj' etcb x41 x42) (?Q'22 s' obj' etcb x41 x42 epptr) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do ep <- get_endpoint epptr;
queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'22 s' obj' etcb x41 x42\<rbrace>
 3. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'18 s' obj' etcb x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'18 s' obj' etcb x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
 5. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ?Q18 s' obj' etcb x41 x42 s
 6. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> ?Q'18 s' obj' etcb x41 x42 s
 7. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 8. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 10. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q18 s' obj' etcb x41 x42) (?Q'27 s' obj' etcb x41 x42 epptr ep) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'22 s' obj' etcb x41 x42 epptr) (get_endpoint epptr)
 5. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'22 s' obj' etcb x41 x42\<rbrace>
 6. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'18 s' obj' etcb x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'18 s' obj' etcb x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
 8. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ?Q18 s' obj' etcb x41 x42 s
 9. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> ?Q'18 s' obj' etcb x41 x42 s
 10. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q18 s' obj' etcb x41 x42) (?Q'32 s' obj' etcb x41 x42 epptr ep queue) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>?Q'32 s' obj' etcb x41 x42 epptr ep\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 5. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'22 s' obj' etcb x41 x42 epptr) (get_endpoint epptr)
 8. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'22 s' obj' etcb x41 x42\<rbrace>
 9. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'18 s' obj' etcb x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'18 s' obj' etcb x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?Q18 s' obj' etcb x41 x42) (?Q'32 s' obj' etcb x41 x42 epptr ep queue) (do return (?b37 s' obj' etcb x41 x42 epptr ep queue);
y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>?Q'32 s' obj' etcb x41 x42 epptr ep\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 5. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'22 s' obj' etcb x41 x42 epptr) (get_endpoint epptr)
 8. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'22 s' obj' etcb x41 x42\<rbrace>
 9. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'18 s' obj' etcb x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'18 s' obj' etcb x41 x42) (get_blocking_object (BlockedOnReceive x41 x42))
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue rv rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R39 s' obj' etcb x41 x42 epptr ep queue rv) (?R'39 s' obj' etcb x41 x42 epptr ep queue rv') (K_bind (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) rv) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q41 s' obj' etcb x41 x42\<rbrace> return (?b37 s' obj' etcb x41 x42 epptr ep queue) \<lbrace>?R39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>?R'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 5. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 7. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 8. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'22 s' obj' etcb x41 x42 epptr) (get_endpoint epptr)
 10. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'22 s' obj' etcb x41 x42\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?R39 s' obj' etcb x41 x42 epptr ep queue rv) (?R'39 s' obj' etcb x41 x42 epptr ep queue ()) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q41 s' obj' etcb x41 x42\<rbrace> return (?b37 s' obj' etcb x41 x42 epptr ep queue) \<lbrace>?R39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>?R'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 5. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 7. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 8. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'22 s' obj' etcb x41 x42 epptr) (get_endpoint epptr)
 10. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'22 s' obj' etcb x41 x42\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?R39 s' obj' etcb x41 x42 epptr ep queue rv) (?R'39 s' obj' etcb x41 x42 epptr ep queue ()) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do return (?b47 s' obj' etcb x41 x42 epptr ep queue rv);
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q41 s' obj' etcb x41 x42\<rbrace> return (?b37 s' obj' etcb x41 x42 epptr ep queue) \<lbrace>?R39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>?R'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 5. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 7. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 8. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'22 s' obj' etcb x41 x42 epptr) (get_endpoint epptr)
 10. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>?Q'22 s' obj' etcb x41 x42\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue rv rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R50 s' obj' etcb x41 x42 epptr ep queue rv rva) (?R'50 s' obj' etcb x41 x42 epptr ep queue rv rv') (KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap) (K_bind (set_thread_state ptr Inactive) rv')
 2. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>?R50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 s' obj' etcb x41 x42 epptr ep queue ()\<rbrace> return (?b47 s' obj' etcb x41 x42 epptr ep queue rv) \<lbrace>?R'50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q41 s' obj' etcb x41 x42\<rbrace> return (?b37 s' obj' etcb x41 x42 epptr ep queue) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace>
 5. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>\<lambda>a. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'53 s' obj' etcb x41 x42 epptr ep queue a\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 7. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 9. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 10. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue rv rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?R50 s' obj' etcb x41 x42 epptr ep queue rv ()) (?R'50 s' obj' etcb x41 x42 epptr ep queue rv rv') (KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>?R50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 s' obj' etcb x41 x42 epptr ep queue ()\<rbrace> return (?b47 s' obj' etcb x41 x42 epptr ep queue rv) \<lbrace>?R'50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q41 s' obj' etcb x41 x42\<rbrace> return (?b37 s' obj' etcb x41 x42 epptr ep queue) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace>
 5. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>\<lambda>a. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'53 s' obj' etcb x41 x42 epptr ep queue a\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 7. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 9. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 10. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>s' obj' etcb x41 x42 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 s' obj' etcb x41 x42 epptr ep queue ()\<rbrace> return (?b47 s' obj' etcb x41 x42 epptr ep queue rv) \<lbrace>\<lambda>rv'. not_idle_thread ptr and K (cdl_cap.NullCap = infer_tcb_pending_op ptr Inactive) and valid_etcbs\<rbrace>
 3. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q41 s' obj' etcb x41 x42\<rbrace> return (?b37 s' obj' etcb x41 x42 epptr ep queue) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q50 s' obj' etcb x41 x42 epptr ep queue rv\<rbrace>
 4. \<And>s' obj' etcb x41 x42 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>\<lambda>a. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'53 s' obj' etcb x41 x42 epptr ep queue a\<rbrace>
 5. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'39 s' obj' etcb x41 x42 epptr ep queue\<rbrace>
 6. \<And>s' obj' etcb x41 x42 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'27 s' obj' etcb x41 x42 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x41 x42 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'27 s' obj' etcb x41 x42 epptr ep) (get_ep_queue ep)
 8. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' obj' etcb x41 x42 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'27 s' obj' etcb x41 x42 epptr\<rbrace>
 9. \<And>s' obj' etcb x41 x42 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; ?Q'22 s' obj' etcb x41 x42 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x41 x42 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (?Q'22 s' obj' etcb x41 x42 epptr) (get_endpoint epptr)
A total of 19 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?P'146 s' obj' etcb x41 x42\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>rv s. ep_at rv s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> ptr \<noteq> idle_thread s \<and> obj_at (\<lambda>ko. \<exists>y. kernel_object.Endpoint y = ko) rv s \<and> valid_idle s \<and> ptr \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; True \<and> valid_reply_caps s \<and> valid_objs s \<and> invs s \<and> ?P'146 s' obj' etcb x41 x42 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnReceive x41 x42) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb x41 x42. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True \<and> valid_reply_caps s \<and> valid_objs s \<and> invs s \<and> ?P'146 s' obj' etcb x41 x42 s) (get_blocking_object (BlockedOnReceive x41 x42))
 4. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 5. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> True \<and> valid_reply_caps s \<and> valid_objs s \<and> invs s \<and> ?P'146 s' obj' etcb x41 x42 s
 6. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 8. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (5 subgoals):
 1. \<And>s' obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; invs s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; s' = s\<rbrakk> \<Longrightarrow> valid_reply_caps s \<and> valid_objs s \<and> ep_at x41 s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> obj_at (\<lambda>ko. \<exists>y. kernel_object.Endpoint y = ko) x41 s \<and> valid_idle s
 2. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 5. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (5 subgoals):
 1. \<And>obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; valid_state s; cur_tcb s\<rbrakk> \<Longrightarrow> valid_reply_caps s \<and> valid_objs s \<and> ep_at x41 s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> ep_at x41 s \<and> valid_idle s
 2. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 5. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (5 subgoals):
 1. \<And>obj' etcb x41 x42 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; valid_state s; cur_tcb s; valid_tcb ptr obj' s\<rbrakk> \<Longrightarrow> valid_reply_caps s \<and> valid_objs s \<and> ep_at x41 s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> ep_at x41 s \<and> valid_idle s
 2. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 5. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (5 subgoals):
 1. \<And>obj' etcb x41 x42 s ko. \<lbrakk>ptr \<noteq> idle_thread s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnReceive x41 x42; cur_tcb s; kheap s ptr = Some (TCB obj'); valid_objs s; \<forall>x\<in>ran tcb_cap_cases. case x of (getF, ab) \<Rightarrow> s \<turnstile> getF obj' \<and> (case ab of (setF, restr) \<Rightarrow> restr ptr (BlockedOnReceive x41 x42) (getF obj')); pspace_aligned s; valid_ipc_buffer_cap (tcb_ipcframe obj') (tcb_ipc_buffer obj'); pspace_distinct s; if_live_then_nonz_cap s; case tcb_fault obj' of None \<Rightarrow> True | Some f \<Rightarrow> valid_fault f; kheap s x41 = Some ko; is_ep ko; zombies_final s; length (tcb_fault_handler obj') = word_bits; sym_refs (state_refs_of s); valid_bound_ntfn (tcb_bound_notification obj') s; valid_arch_tcb (tcb_arch obj') s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s
 2. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 5. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (4 subgoals):
 1. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (blocked_cancel_ipc (BlockedOnSend x51 x52) ptr)
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 3. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 4. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (4 subgoals):
 1. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do epptr <- get_blocking_object (BlockedOnSend x51 x52);
ep <- get_endpoint epptr;
queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 3. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 4. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (6 subgoals):
 1. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc (?Q206 s' obj' etcb x51 x52) (?Q'206 s' obj' etcb x51 x52) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do epptr <- get_blocking_object (BlockedOnSend x51 x52);
ep <- get_endpoint epptr;
queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; transform s' = s\<rbrakk> \<Longrightarrow> ?Q206 s' obj' etcb x51 x52 s
 3. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; s' = s\<rbrakk> \<Longrightarrow> ?Q'206 s' obj' etcb x51 x52 s
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 5. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 6. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc (?Q206 s' obj' etcb x51 x52) (?Q'210 s' obj' etcb x51 x52 epptr) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do ep <- get_endpoint epptr;
queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'206 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>?Q'210 s' obj' etcb x51 x52\<rbrace>
 3. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'206 s' obj' etcb x51 x52 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'206 s' obj' etcb x51 x52) (get_blocking_object (BlockedOnSend x51 x52))
 5. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; transform s' = s\<rbrakk> \<Longrightarrow> ?Q206 s' obj' etcb x51 x52 s
 6. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; s' = s\<rbrakk> \<Longrightarrow> ?Q'206 s' obj' etcb x51 x52 s
 7. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 8. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc (?Q206 s' obj' etcb x51 x52) (?Q'215 s' obj' etcb x51 x52 epptr ep) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do queue <- get_ep_queue ep;
y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'210 s' obj' etcb x51 x52 epptr) (get_endpoint epptr)
 5. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'206 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>?Q'210 s' obj' etcb x51 x52\<rbrace>
 6. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'206 s' obj' etcb x51 x52 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'206 s' obj' etcb x51 x52) (get_blocking_object (BlockedOnSend x51 x52))
 8. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; transform s' = s\<rbrakk> \<Longrightarrow> ?Q206 s' obj' etcb x51 x52 s
 9. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; s' = s\<rbrakk> \<Longrightarrow> ?Q'206 s' obj' etcb x51 x52 s
 10. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc (?Q206 s' obj' etcb x51 x52) (?Q'220 s' obj' etcb x51 x52 epptr ep queue) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>?Q'220 s' obj' etcb x51 x52 epptr ep\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 5. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'210 s' obj' etcb x51 x52 epptr) (get_endpoint epptr)
 8. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'206 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>?Q'210 s' obj' etcb x51 x52\<rbrace>
 9. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'206 s' obj' etcb x51 x52 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'206 s' obj' etcb x51 x52) (get_blocking_object (BlockedOnSend x51 x52))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc (?Q206 s' obj' etcb x51 x52) (?Q'220 s' obj' etcb x51 x52 epptr ep queue) (do return (?b225 s' obj' etcb x51 x52 epptr ep queue);
y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do y <- set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>?Q'220 s' obj' etcb x51 x52 epptr ep\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 5. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'210 s' obj' etcb x51 x52 epptr) (get_endpoint epptr)
 8. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'206 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>?Q'210 s' obj' etcb x51 x52\<rbrace>
 9. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'206 s' obj' etcb x51 x52 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'206 s' obj' etcb x51 x52) (get_blocking_object (BlockedOnSend x51 x52))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue rv rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R227 s' obj' etcb x51 x52 epptr ep queue rv) (?R'227 s' obj' etcb x51 x52 epptr ep queue rv') (K_bind (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) rv) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q229 s' obj' etcb x51 x52\<rbrace> return (?b225 s' obj' etcb x51 x52 epptr ep queue) \<lbrace>?R227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>?R'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 5. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 7. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 8. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'210 s' obj' etcb x51 x52 epptr) (get_endpoint epptr)
 10. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'206 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>?Q'210 s' obj' etcb x51 x52\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc (?R227 s' obj' etcb x51 x52 epptr ep queue rv) (?R'227 s' obj' etcb x51 x52 epptr ep queue ()) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q229 s' obj' etcb x51 x52\<rbrace> return (?b225 s' obj' etcb x51 x52 epptr ep queue) \<lbrace>?R227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>?R'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 5. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 7. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 8. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'210 s' obj' etcb x51 x52 epptr) (get_endpoint epptr)
 10. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'206 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>?Q'210 s' obj' etcb x51 x52\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> dcorres dc (?R227 s' obj' etcb x51 x52 epptr ep queue rv) (?R'227 s' obj' etcb x51 x52 epptr ep queue ()) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do return (?b235 s' obj' etcb x51 x52 epptr ep queue rv);
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q229 s' obj' etcb x51 x52\<rbrace> return (?b225 s' obj' etcb x51 x52 epptr ep queue) \<lbrace>?R227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>?R'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 5. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 7. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 8. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'210 s' obj' etcb x51 x52 epptr) (get_endpoint epptr)
 10. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'206 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>?Q'210 s' obj' etcb x51 x52\<rbrace>
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue rv rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R238 s' obj' etcb x51 x52 epptr ep queue rv rva) (?R'238 s' obj' etcb x51 x52 epptr ep queue rv rv') (KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap) (K_bind (set_thread_state ptr Inactive) rv')
 2. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>?R238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'241 s' obj' etcb x51 x52 epptr ep queue ()\<rbrace> return (?b235 s' obj' etcb x51 x52 epptr ep queue rv) \<lbrace>?R'238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q229 s' obj' etcb x51 x52\<rbrace> return (?b225 s' obj' etcb x51 x52 epptr ep queue) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace>
 5. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>\<lambda>a. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'241 s' obj' etcb x51 x52 epptr ep queue a\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 7. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 9. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 10. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue rv rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R238 s' obj' etcb x51 x52 epptr ep queue rv rva) (?R'238 s' obj' etcb x51 x52 epptr ep queue rv rv') (KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>?R238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'241 s' obj' etcb x51 x52 epptr ep queue ()\<rbrace> return (?b235 s' obj' etcb x51 x52 epptr ep queue rv) \<lbrace>?R'238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q229 s' obj' etcb x51 x52\<rbrace> return (?b225 s' obj' etcb x51 x52 epptr ep queue) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace>
 5. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>\<lambda>a. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'241 s' obj' etcb x51 x52 epptr ep queue a\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 7. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 9. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 10. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>s' obj' etcb x51 x52 epptr ep queue rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'241 s' obj' etcb x51 x52 epptr ep queue ()\<rbrace> return (?b235 s' obj' etcb x51 x52 epptr ep queue rv) \<lbrace>\<lambda>rv'. not_idle_thread ptr and K (cdl_cap.NullCap = infer_tcb_pending_op ptr Inactive) and valid_etcbs\<rbrace>
 3. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q229 s' obj' etcb x51 x52\<rbrace> return (?b225 s' obj' etcb x51 x52 epptr ep queue) \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q238 s' obj' etcb x51 x52 epptr ep queue rv\<rbrace>
 4. \<And>s' obj' etcb x51 x52 epptr ep queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace> set_endpoint epptr (case remove1 ptr queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 ptr queue)) \<lbrace>\<lambda>a. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'241 s' obj' etcb x51 x52 epptr ep queue a\<rbrace>
 5. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr ep\<rbrace> get_ep_queue ep \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'227 s' obj' etcb x51 x52 epptr ep queue\<rbrace>
 6. \<And>s' obj' etcb x51 x52 epptr ep s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'215 s' obj' etcb x51 x52 epptr ep s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_ep_queue ep \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x51 x52 epptr ep. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'215 s' obj' etcb x51 x52 epptr ep) (get_ep_queue ep)
 8. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?Q'210 s' obj' etcb x51 x52 epptr\<rbrace> get_endpoint epptr \<lbrace>?Q'215 s' obj' etcb x51 x52 epptr\<rbrace>
 9. \<And>s' obj' etcb x51 x52 epptr s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; ?Q'210 s' obj' etcb x51 x52 epptr s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x51 x52 epptr. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (?Q'210 s' obj' etcb x51 x52 epptr) (get_endpoint epptr)
A total of 18 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?P'338 s' obj' etcb x51 x52\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>\<lambda>rv s. ep_at rv s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> ptr \<noteq> idle_thread s \<and> obj_at (\<lambda>ko. \<exists>y. kernel_object.Endpoint y = ko) rv s \<and> valid_idle s \<and> ptr \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; True \<and> valid_reply_caps s \<and> valid_objs s \<and> invs s \<and> ?P'338 s' obj' etcb x51 x52 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_blocking_object (BlockedOnSend x51 x52) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb x51 x52. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True \<and> valid_reply_caps s \<and> valid_objs s \<and> invs s \<and> ?P'338 s' obj' etcb x51 x52 s) (get_blocking_object (BlockedOnSend x51 x52))
 4. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 5. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; s' = s\<rbrakk> \<Longrightarrow> True \<and> valid_reply_caps s \<and> valid_objs s \<and> invs s \<and> ?P'338 s' obj' etcb x51 x52 s
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 8. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (4 subgoals):
 1. \<And>s' obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; invs s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; s' = s\<rbrakk> \<Longrightarrow> valid_reply_caps s \<and> valid_objs s \<and> ep_at x51 s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> obj_at (\<lambda>ko. \<exists>y. kernel_object.Endpoint y = ko) x51 s \<and> valid_idle s
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 3. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 4. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (4 subgoals):
 1. \<And>obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; valid_state s; cur_tcb s\<rbrakk> \<Longrightarrow> valid_reply_caps s \<and> valid_objs s \<and> ep_at x51 s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> ep_at x51 s \<and> valid_idle s
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 3. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 4. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (4 subgoals):
 1. \<And>obj' etcb x51 x52 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; valid_state s; cur_tcb s; valid_tcb ptr obj' s\<rbrakk> \<Longrightarrow> valid_reply_caps s \<and> valid_objs s \<and> ep_at x51 s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. a \<noteq> BlockedOnReply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> ep_at x51 s \<and> valid_idle s
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 3. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 4. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (4 subgoals):
 1. \<And>obj' etcb x51 x52 s ko. \<lbrakk>ptr \<noteq> idle_thread s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnSend x51 x52; cur_tcb s; kheap s ptr = Some (TCB obj'); valid_objs s; \<forall>x\<in>ran tcb_cap_cases. case x of (getF, ab) \<Rightarrow> s \<turnstile> getF obj' \<and> (case ab of (setF, restr) \<Rightarrow> restr ptr (BlockedOnSend x51 x52) (getF obj')); pspace_aligned s; valid_ipc_buffer_cap (tcb_ipcframe obj') (tcb_ipc_buffer obj'); pspace_distinct s; if_live_then_nonz_cap s; case tcb_fault obj' of None \<Rightarrow> True | Some f \<Rightarrow> valid_fault f; kheap s x51 = Some ko; is_ep ko; zombies_final s; length (tcb_fault_handler obj') = word_bits; sym_refs (state_refs_of s); valid_bound_ntfn (tcb_bound_notification obj') s; valid_arch_tcb (tcb_arch obj') s; sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 3. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 4. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (3 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (reply_cancel_ipc ptr)
 2. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 3. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (3 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (do y <- thread_set (tcb_fault_update (\<lambda>_. None)) ptr;
cap <- CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2);
descs <- gets (CSpaceAcc_A.descendants_of (ptr, tcb_cnode_index 2) \<circ> cdt);
when (descs \<noteq> {}) (do y <- assert (\<exists>a b. descs = {(a, b)});
select descs >>= cap_delete_one
od)
od)
 2. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 3. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (5 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc (?Q398 s' obj' etcb) (?Q'398 s' obj' etcb) (do y <- update_thread_fault ptr (\<lambda>x. False);
revoke_cap_simple (ptr, tcb_replycap_slot)
od) (do y <- thread_set (tcb_fault_update (\<lambda>_. None)) ptr;
cap <- CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2);
descs <- gets (CSpaceAcc_A.descendants_of (ptr, tcb_cnode_index 2) \<circ> cdt);
when (descs \<noteq> {}) (do y <- assert (\<exists>a b. descs = {(a, b)});
select descs >>= cap_delete_one
od)
od)
 2. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); transform s' = s\<rbrakk> \<Longrightarrow> ?Q398 s' obj' etcb s
 3. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); s' = s\<rbrakk> \<Longrightarrow> ?Q'398 s' obj' etcb s
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 5. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (8 subgoals):
 1. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres (?r'402 s' obj' etcb) (?P402 s' obj' etcb) (?P'402 s' obj' etcb) (update_thread_fault ptr (\<lambda>x. False)) (thread_set (tcb_fault_update (\<lambda>_. None)) ptr)
 2. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); ?r'402 s' obj' etcb y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R402 s' obj' etcb y) (?R'402 s' obj' etcb ya) (revoke_cap_simple (ptr, tcb_replycap_slot)) (do cap <- CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2);
descs <- gets (CSpaceAcc_A.descendants_of (ptr, tcb_cnode_index 2) \<circ> cdt);
when (descs \<noteq> {}) (do y <- assert (\<exists>a b. descs = {(a, b)});
select descs >>= cap_delete_one
od)
od)
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 s' obj' etcb\<rbrace> update_thread_fault ptr (\<lambda>x. False) \<lbrace>?R402 s' obj' etcb\<rbrace>
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'402 s' obj' etcb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) ptr \<lbrace>?R'402 s' obj' etcb\<rbrace>
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); transform s' = s\<rbrakk> \<Longrightarrow> (?P402 s' obj' etcb and ?Q402 s' obj' etcb) s
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); s' = s\<rbrakk> \<Longrightarrow> (?P'402 s' obj' etcb and ?Q'402 s' obj' etcb) s
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 8. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (7 subgoals):
 1. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R402 s' obj' etcb y) (?R'402 s' obj' etcb ya) (revoke_cap_simple (ptr, tcb_replycap_slot)) (do cap <- CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2);
descs <- gets (CSpaceAcc_A.descendants_of (ptr, tcb_cnode_index 2) \<circ> cdt);
when (descs \<noteq> {}) (do y <- assert (\<exists>a b. descs = {(a, b)});
select descs >>= cap_delete_one
od)
od)
 2. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 s' obj' etcb\<rbrace> update_thread_fault ptr (\<lambda>x. False) \<lbrace>?R402 s' obj' etcb\<rbrace>
 3. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'402 s' obj' etcb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) ptr \<lbrace>?R'402 s' obj' etcb\<rbrace>
 4. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q402 s' obj' etcb) s
 5. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); s' = s\<rbrakk> \<Longrightarrow> (tcb_at ptr and not_idle_thread ptr and valid_etcbs and ?Q'402 s' obj' etcb) s
 6. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 7. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb y ya cap. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R402 s' obj' etcb y) (?Q'413 s' obj' etcb y ya cap) (revoke_cap_simple (ptr, tcb_replycap_slot)) (do descs <- gets (CSpaceAcc_A.descendants_of (ptr, tcb_cnode_index 2) \<circ> cdt);
when (descs \<noteq> {}) (do y <- assert (\<exists>a b. descs = {(a, b)});
select descs >>= cap_delete_one
od)
od)
 2. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?R'402 s' obj' etcb ya\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>?Q'413 s' obj' etcb y ya\<rbrace>
 3. \<And>s' obj' etcb y ya s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; ?R'402 s' obj' etcb ya s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; False\<rbrakk> \<Longrightarrow> no_fail (?R'402 s' obj' etcb ya) (CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2))
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 s' obj' etcb\<rbrace> update_thread_fault ptr (\<lambda>x. False) \<lbrace>?R402 s' obj' etcb\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'402 s' obj' etcb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) ptr \<lbrace>?R'402 s' obj' etcb\<rbrace>
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q402 s' obj' etcb) s
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); s' = s\<rbrakk> \<Longrightarrow> (tcb_at ptr and not_idle_thread ptr and valid_etcbs and ?Q'402 s' obj' etcb) s
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 10. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb cap. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc (?R402 s' obj' etcb ()) (?Q'413 s' obj' etcb () () cap) (revoke_cap_simple (ptr, tcb_replycap_slot)) (do descs <- gets (CSpaceAcc_A.descendants_of (ptr, tcb_cnode_index 2) \<circ> cdt);
when (descs \<noteq> {}) (do y <- assert (\<exists>a b. descs = {(a, b)});
select descs >>= cap_delete_one
od)
od)
 2. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?R'402 s' obj' etcb ya\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>?Q'413 s' obj' etcb y ya\<rbrace>
 3. \<And>s' obj' etcb y ya s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; ?R'402 s' obj' etcb ya s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; False\<rbrakk> \<Longrightarrow> no_fail (?R'402 s' obj' etcb ya) (CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2))
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 s' obj' etcb\<rbrace> update_thread_fault ptr (\<lambda>x. False) \<lbrace>?R402 s' obj' etcb\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'402 s' obj' etcb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) ptr \<lbrace>?R'402 s' obj' etcb\<rbrace>
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q402 s' obj' etcb) s
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); s' = s\<rbrakk> \<Longrightarrow> (tcb_at ptr and not_idle_thread ptr and valid_etcbs and ?Q'402 s' obj' etcb) s
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 10. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb cap. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> dcorres dc (?R419 s' obj' etcb cap (?s'419 s' obj' etcb cap) (?obj'419 s' obj' etcb cap) (?etcb419 s' obj' etcb cap) ()) (?Q'419 s' obj' etcb cap (?s'419 s' obj' etcb cap) (?obj'419 s' obj' etcb cap) (?etcb419 s' obj' etcb cap) () () (?cap419 s' obj' etcb cap)) (revoke_cap_simple (transform_cslot_ptr (ptr, tcb_cnode_index 2))) (do descs <- gets (CSpaceAcc_A.descendants_of (ptr, tcb_cnode_index 2) \<circ> cdt);
when (descs \<noteq> {}) (do y <- assert (\<exists>a b. descs = {(a, b)});
select descs >>= cap_delete_one
od)
od)
 2. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?R'402 s' obj' etcb ya\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>?Q'413 s' obj' etcb y ya\<rbrace>
 3. \<And>s' obj' etcb y ya s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; ?R'402 s' obj' etcb ya s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; False\<rbrakk> \<Longrightarrow> no_fail (?R'402 s' obj' etcb ya) (CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2))
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 s' obj' etcb\<rbrace> update_thread_fault ptr (\<lambda>x. False) \<lbrace>?R402 s' obj' etcb\<rbrace>
 6. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'402 s' obj' etcb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) ptr \<lbrace>?R'402 s' obj' etcb\<rbrace>
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q402 s' obj' etcb) s
 8. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); s' = s\<rbrakk> \<Longrightarrow> (tcb_at ptr and not_idle_thread ptr and valid_etcbs and ?Q'402 s' obj' etcb) s
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 10. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y
flex-flex pairs:
\<lambda>s' obj' etcb cap. ?Q'419 s' obj' etcb cap (?s'419 s' obj' etcb cap) (?obj'419 s' obj' etcb cap) (?etcb419 s' obj' etcb cap) () () (?cap419 s' obj' etcb cap) \<equiv>\<^sup>? \<lambda>s' obj' etcb. ?Q'413 s' obj' etcb () ()
\<lambda>s' obj' etcb cap. ?R419 s' obj' etcb cap (?s'419 s' obj' etcb cap) (?obj'419 s' obj' etcb cap) (?etcb419 s' obj' etcb cap) () \<equiv>\<^sup>? \<lambda>s' obj' etcb cap. ?R402 s' obj' etcb () proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?R'402 s' obj' etcb ya\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>\<lambda>a. invs and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and valid_etcbs\<rbrace>
 2. \<And>s' obj' etcb y ya s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; ?R'402 s' obj' etcb ya s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb y ya. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); dc y ya; False\<rbrakk> \<Longrightarrow> no_fail (?R'402 s' obj' etcb ya) (CSpaceAcc_A.get_cap (ptr, tcb_cnode_index 2))
 4. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q402 s' obj' etcb\<rbrace> update_thread_fault ptr (\<lambda>x. False) \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>s' obj' etcb. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'402 s' obj' etcb\<rbrace> thread_set (tcb_fault_update (\<lambda>_. None)) ptr \<lbrace>?R'402 s' obj' etcb\<rbrace>
 6. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q402 s' obj' etcb) s
 7. \<And>s' obj' etcb s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; awaiting_reply (tcb_state obj'); s' = s\<rbrakk> \<Longrightarrow> (tcb_at ptr and not_idle_thread ptr and valid_etcbs and ?Q'402 s' obj' etcb) s
 8. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (3 subgoals):
 1. \<And>obj' etcb s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; invs s; valid_etcbs s; get_etcb ptr s = Some etcb; awaiting_reply (tcb_state obj')\<rbrakk> \<Longrightarrow> tcb_at ptr s \<and> not_idle_thread ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s
 2. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 3. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (2 subgoals):
 1. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (cancel_signal ptr x7)
 2. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (2 subgoals):
 1. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do ntfn <- get_notification x7;
queue <- case ntfn_obj ntfn of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail;
y <- set_notification x7 (ntfn_set_obj ntfn (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue)));
set_thread_state ptr Inactive
od)
 2. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (4 subgoals):
 1. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc (?Q450 s' obj' etcb x7) (?Q'450 s' obj' etcb x7) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do ntfn <- get_notification x7;
queue <- case ntfn_obj ntfn of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail;
y <- set_notification x7 (ntfn_set_obj ntfn (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue)));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ?Q450 s' obj' etcb x7 s
 3. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 4. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (7 subgoals):
 1. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc (?Q450 s' obj' etcb x7) (valid_ntfn rv and (=) s') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do queue <- case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail;
y <- set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue)));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 3. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 5. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ?Q450 s' obj' etcb x7 s
 6. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 7. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc (?Q450 s' obj' etcb x7) (?Q'455 s' obj' etcb x7 rv queue) (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do y <- set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue)));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>?Q'455 s' obj' etcb x7 rv\<rbrace>
 3. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 5. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 6. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ?Q450 s' obj' etcb x7 s
 9. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 10. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (10 subgoals):
 1. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> dcorres dc (?Q450 s' obj' etcb x7) (?Q'455 s' obj' etcb x7 rv queue) (do return (?b460 s' obj' etcb x7 rv queue);
y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do y <- set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue)));
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>?Q'455 s' obj' etcb x7 rv\<rbrace>
 3. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 5. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 6. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ?Q450 s' obj' etcb x7 s
 9. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 10. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R462 s' obj' etcb x7 rv queue rva) (?R'462 s' obj' etcb x7 rv queue rv') (K_bind (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) rva) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q464 s' obj' etcb x7\<rbrace> return (?b460 s' obj' etcb x7 rv queue) \<lbrace>?R462 s' obj' etcb x7 rv queue\<rbrace>
 3. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'462 s' obj' etcb x7 rv queue\<rbrace> set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) \<lbrace>?R'462 s' obj' etcb x7 rv queue\<rbrace>
 4. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'462 s' obj' etcb x7 rv queue\<rbrace>
 5. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 10. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q464 s' obj' etcb x7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R462 s' obj' etcb x7 rv queue rva) (?R'462 s' obj' etcb x7 rv queue rv') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q464 s' obj' etcb x7\<rbrace> return (?b460 s' obj' etcb x7 rv queue) \<lbrace>?R462 s' obj' etcb x7 rv queue\<rbrace>
 3. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'462 s' obj' etcb x7 rv queue\<rbrace> set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) \<lbrace>?R'462 s' obj' etcb x7 rv queue\<rbrace>
 4. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'462 s' obj' etcb x7 rv queue\<rbrace>
 5. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 10. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q464 s' obj' etcb x7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R462 s' obj' etcb x7 rv queue rva) (?R'462 s' obj' etcb x7 rv queue rv') (do y <- revoke_cap_simple (ptr, tcb_replycap_slot);
KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap
od) (do return (?b468 s' obj' etcb x7 rv queue rva rv');
set_thread_state ptr Inactive
od)
 2. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q464 s' obj' etcb x7\<rbrace> return (?b460 s' obj' etcb x7 rv queue) \<lbrace>?R462 s' obj' etcb x7 rv queue\<rbrace>
 3. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'462 s' obj' etcb x7 rv queue\<rbrace> set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) \<lbrace>?R'462 s' obj' etcb x7 rv queue\<rbrace>
 4. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'462 s' obj' etcb x7 rv queue\<rbrace>
 5. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 7. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 10. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q464 s' obj' etcb x7) s
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' obj' etcb x7 rv queue rva rv' y rv'a. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'; dc y rv'a\<rbrakk> \<Longrightarrow> dcorres dc (?R470 s' obj' etcb x7 rv queue rva rv' y) (?R'470 s' obj' etcb x7 rv queue rva rv' rv'a) (KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap) (K_bind (set_thread_state ptr Inactive) rv'a)
 2. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q472 s' obj' etcb x7 rv queue rva\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>?R470 s' obj' etcb x7 rv queue rva rv'\<rbrace>
 3. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace> return (?b468 s' obj' etcb x7 rv queue rva rv') \<lbrace>?R'470 s' obj' etcb x7 rv queue rva rv'\<rbrace>
 4. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q464 s' obj' etcb x7\<rbrace> return (?b460 s' obj' etcb x7 rv queue) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q472 s' obj' etcb x7 rv queue rva\<rbrace>
 5. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'462 s' obj' etcb x7 rv queue\<rbrace> set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) \<lbrace>\<lambda>rv'. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace>
 6. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'462 s' obj' etcb x7 rv queue\<rbrace>
 7. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 10. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' obj' etcb x7 rv queue rva rv' y rv'a. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'; dc y rv'a\<rbrakk> \<Longrightarrow> dcorres dc (?R470 s' obj' etcb x7 rv queue rva rv' y) (?R'470 s' obj' etcb x7 rv queue rva rv' rv'a) (KHeap_D.set_cap (ptr, tcb_pending_op_slot) cdl_cap.NullCap) (set_thread_state ptr Inactive)
 2. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q472 s' obj' etcb x7 rv queue rva\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>?R470 s' obj' etcb x7 rv queue rva rv'\<rbrace>
 3. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace> return (?b468 s' obj' etcb x7 rv queue rva rv') \<lbrace>?R'470 s' obj' etcb x7 rv queue rva rv'\<rbrace>
 4. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q464 s' obj' etcb x7\<rbrace> return (?b460 s' obj' etcb x7 rv queue) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q472 s' obj' etcb x7 rv queue rva\<rbrace>
 5. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'462 s' obj' etcb x7 rv queue\<rbrace> set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) \<lbrace>\<lambda>rv'. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace>
 6. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'462 s' obj' etcb x7 rv queue\<rbrace>
 7. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 9. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 10. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q472 s' obj' etcb x7 rv queue rva\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace> return (?b468 s' obj' etcb x7 rv queue rva rv') \<lbrace>\<lambda>rv'a. not_idle_thread ptr and K (cdl_cap.NullCap = infer_tcb_pending_op ptr Inactive) and valid_etcbs\<rbrace>
 3. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q464 s' obj' etcb x7\<rbrace> return (?b460 s' obj' etcb x7 rv queue) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q472 s' obj' etcb x7 rv queue rva\<rbrace>
 4. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'462 s' obj' etcb x7 rv queue\<rbrace> set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) \<lbrace>\<lambda>rv'. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace>
 5. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'462 s' obj' etcb x7 rv queue\<rbrace>
 6. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 8. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 9. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q472 s' obj' etcb x7 rv queue rva\<rbrace> revoke_cap_simple (ptr, tcb_replycap_slot) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>s' obj' etcb x7 rv queue rva rv'. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace> return (?b468 s' obj' etcb x7 rv queue rva rv') \<lbrace>\<lambda>rv'a. not_idle_thread ptr and K (cdl_cap.NullCap = infer_tcb_pending_op ptr Inactive) and valid_etcbs\<rbrace>
 3. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q464 s' obj' etcb x7\<rbrace> return (?b460 s' obj' etcb x7 rv queue) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q472 s' obj' etcb x7 rv queue rva\<rbrace>
 4. \<And>s' obj' etcb x7 rv queue. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'462 s' obj' etcb x7 rv queue\<rbrace> set_notification x7 (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) \<lbrace>\<lambda>rv'. valid_reply_caps and valid_objs and only_idle and valid_mdb and st_tcb_at (Not \<circ> awaiting_reply) ptr and cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) and not_idle_thread ptr and valid_idle and ?Q'476 s' obj' etcb x7 rv queue rv'\<rbrace>
 5. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue. (\<lambda>_. True) and ?Q'462 s' obj' etcb x7 rv queue\<rbrace>
 6. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 8. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 9. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
A total of 13 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>valid_ntfn rv and (=) s'\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>queue s. valid_reply_caps s \<and> valid_objs s \<and> valid_ntfn (ntfn_set_obj rv (case remove1 ptr queue of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr queue))) s \<and> only_idle s \<and> valid_mdb s \<and> st_tcb_at (Not \<circ> awaiting_reply) ptr s \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s \<and> ptr \<noteq> idle_thread s \<and> obj_at (\<lambda>ko. \<exists>y. kernel_object.Notification y = ko) x7 s \<and> valid_idle s \<and> ptr \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 5. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 7. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb x7 rv x2. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ntfn_obj rv = WaitingNtfn x2; valid_ntfn rv s'\<rbrakk> \<Longrightarrow> valid_reply_caps s' \<and> valid_objs s' \<and> valid_ntfn (ntfn_set_obj rv (case remove1 ptr x2 of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr x2))) s' \<and> only_idle s' \<and> valid_mdb s' \<and> st_tcb_at (Not \<circ> awaiting_reply) ptr s' \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s' \<and> obj_at (\<lambda>ko. \<exists>y. kernel_object.Notification y = ko) x7 s' \<and> valid_idle s'
 2. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 5. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 7. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb x7 rv x2. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ntfn_obj rv = WaitingNtfn x2; valid_ntfn rv s'; valid_state s'; cur_tcb s'\<rbrakk> \<Longrightarrow> valid_reply_caps s' \<and> valid_objs s' \<and> valid_ntfn (ntfn_set_obj rv (case remove1 ptr x2 of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr x2))) s' \<and> only_idle s' \<and> valid_mdb s' \<and> st_tcb_at (Not \<circ> awaiting_reply) ptr s' \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s' \<and> ntfn_at x7 s' \<and> valid_idle s'
 2. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 5. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 7. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb x7 rv x2. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ntfn_obj rv = WaitingNtfn x2; valid_ntfn rv s'; valid_state s'; cur_tcb s'; valid_tcb ptr obj' s'\<rbrakk> \<Longrightarrow> valid_reply_caps s' \<and> valid_objs s' \<and> valid_ntfn (ntfn_set_obj rv (case remove1 ptr x2 of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr x2))) s' \<and> only_idle s' \<and> valid_mdb s' \<and> st_tcb_at (Not \<circ> awaiting_reply) ptr s' \<and> cte_wp_at (\<lambda>_. True) (ptr, tcb_cnode_index 2) s' \<and> ntfn_at x7 s' \<and> valid_idle s'
 2. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 5. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 7. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (9 subgoals):
 1. \<And>s' obj' etcb x7 rv x2 ko. \<lbrakk>ptr \<noteq> idle_thread s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ntfn_obj rv = WaitingNtfn x2; valid_ntfn rv s'; cur_tcb s'; kheap s' ptr = Some (TCB obj'); valid_objs s'; \<forall>x\<in>ran tcb_cap_cases. case x of (getF, ab) \<Rightarrow> s' \<turnstile> getF obj' \<and> (case ab of (setF, restr) \<Rightarrow> restr ptr (BlockedOnNotification x7) (getF obj')); pspace_aligned s'; valid_ipc_buffer_cap (tcb_ipcframe obj') (tcb_ipc_buffer obj'); pspace_distinct s'; if_live_then_nonz_cap s'; case tcb_fault obj' of None \<Rightarrow> True | Some f \<Rightarrow> valid_fault f; kheap s' x7 = Some ko; is_ntfn ko; zombies_final s'; length (tcb_fault_handler obj') = word_bits; sym_refs (state_refs_of s'); valid_bound_ntfn (tcb_bound_notification obj') s'; valid_arch_tcb (tcb_arch obj') s'; sym_refs (state_hyp_refs_of s'); valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> valid_ntfn (ntfn_set_obj rv (case remove1 ptr x2 of [] \<Rightarrow> IdleNtfn | a # list \<Rightarrow> WaitingNtfn (remove1 ptr x2))) s'
 2. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 4. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 5. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 7. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 8. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 9. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (8 subgoals):
 1. \<And>s' obj' etcb x7 rv s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; (valid_ntfn rv and (=) s') s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>s' obj' etcb x7 rv. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (valid_ntfn rv and (=) s') (case ntfn_obj rv of WaitingNtfn queue \<Rightarrow> return queue | _ \<Rightarrow> fail)
 3. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> \<lbrace>?Q'450 s' obj' etcb x7\<rbrace> get_notification x7 \<lbrace>\<lambda>r. valid_ntfn r and (=) s'\<rbrace>
 4. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; ?Q'450 s' obj' etcb x7 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_notification x7 \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>s' obj' etcb x7. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; False\<rbrakk> \<Longrightarrow> no_fail (?Q'450 s' obj' etcb x7) (get_notification x7)
 6. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>_. True))) s
 7. \<And>s' obj' etcb x7 s. \<lbrakk>get_tcb ptr s' = Some obj'; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; get_etcb ptr s' = Some etcb; tcb_state obj' = BlockedOnNotification x7; s' = s\<rbrakk> \<Longrightarrow> ?Q'450 s' obj' etcb x7 s
 8. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (2 subgoals):
 1. \<And>obj' etcb x7 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; invs s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnNotification x7\<rbrakk> \<Longrightarrow> valid_objs s \<and> ntfn_at x7 s
 2. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (2 subgoals):
 1. \<And>obj' etcb x7 s. \<lbrakk>get_tcb ptr s = Some obj'; ptr \<noteq> idle_thread s; valid_etcbs s; get_etcb ptr s = Some etcb; tcb_state obj' = BlockedOnNotification x7; valid_state s; cur_tcb s; valid_tcb ptr obj' s\<rbrakk> \<Longrightarrow> valid_objs s \<and> ntfn_at x7 s
 2. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>s = transform s'; ptr \<noteq> idle_thread s' \<and> invs s' \<and> valid_etcbs s'; \<exists>y. get_tcb ptr s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal (1 subgoal):
 1. \<And>s' y. \<lbrakk>get_tcb ptr s' = Some y; ptr \<noteq> idle_thread s'; invs s'; valid_etcbs s'; \<exists>etcb. get_etcb ptr s' = Some etcb\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (ptr, tcb_pending_op_slot) (transform s') = Some y proof (prove)
goal:
No subgoals!